Risk Recommendations

The potential impact of a change to a Risk Control can be estimated using Monte Carlo analysis. A what-if scenario will be ran that compares the residual risk before and after the implementation change.

Create a Risk Recommendation — Propose a change to a Risk Control across the entire Organization or for a specific Information System The user may make a Risk Recommendation on a Non-Standard Control for a System If making a Recommendation on a Standard control for a System, the Recommendation is made across all Systems with that Standard Control.