Failure to engage in IT risk identification and impact analysis involving multi-disciplinary functionsControlPeriodically re-evaluate risk assessments