Phase V: Test

During this phase, the organization should rigorously and skeptically test every assumption and system for weakness. Testing should also be built into the standard practices of the organization to occur on a regular basis. This phase is not only designed to determine if the effort at any one point is effective and where it can be improved upon, but also to create a regular and in-depth process for testing all policies, procedures, personnel, and controls for ongoing effectiveness. When first creating a risk management program, this can be accomplished by conducting another set of vulnerability assessments.