- manage risk by analysing the root cause of issues, impact to business, and required corrective actions
- collect and analyse security risk evidence, and coordinate with internal and external auditing agencies
- develop procedures and process control manuals