Comprehensive and Detailed Explanation (aligned to ISACA CRISC guidance) During risk analysis, CRISC distinguishes between inherent risk (without controls) and residual or current risk (with controls). Analyzing control effectiveness-both in design and operation-is central to determining the current risk level. Effective controls reduce either the likelihood of occurrence, the impact, or both. The assessment of their strength, coverage, and reliability allows the practitioner to adjust the initial inherent risk estimate down to a realistic residual risk figure and compare this to appetite and tolerance. Cost-benefit analysis of controls is a later step in risk response decision-making. Impact evaluation depends more on the nature of assets and processes than on controls. Likelihood is influenced by controls, but the primary purpose of control effectiveness analysis is to calculate the updated (residual) risk level, not just likelihood independently.
Reference: CRISC Review Manual - Risk Assessment (control analysis and inherent vs residual risk).