During a risk assessment, what should an assessor do after identifying threats to organizational assets?

The CRISC risk assessment process follows asequence:

Identify assets →

Identify threats →

Identify vulnerabilities →

Evaluate existing controls→

Assess likelihood and impact.

Per ISACA CRISC guidance:

“After identifying threats, the next step is to evaluate the effectiveness of existing controls to determine residual risk.”

Implementing new controls (Option C) happensafterrisk evaluation and treatment planning.

Hence,D. Evaluate the controls currently in placeis correct.

CRISC Reference:Domain 2 – IT Risk Assessment, Topic: Risk Identification and Control Evaluation Steps.