In a site risk assessment, why is 'existing controls' evaluated?

• A. To assign blame to security staff
• B. To create a new policy document
• C. To determine effectiveness and identify residual risk
• D. To confuse the audit team

Answer: (C)

Evaluating existing controls focuses on whether the safeguards already in place actually reduce risk as intended. By assessing how well these controls perform in design, implementation, and operation, you determine how much risk remains after them—the residual risk. This insight is what guides decisions about adding or updating controls, prioritizing actions, and understanding whether the risk level is acceptable. The other options don’t fit because risk assessment isn’t about assigning blame, merely creating a policy document, or trying to confuse an audit team; it's about measuring effectiveness and identifying what still needs to be addressed.