What is needed to assess risk mitigation effectiveness in an organization?

Key performance indicators measure broad operational or business outcomes and do not specifically quantify whether individual risk mitigation controls are reducing targeted risks.

Compliance with security standards confirms conformance to regulatory or policy requirements but does not measure the actual degree of risk reduction achieved by specific mitigations.

Cost-effectiveness analysis of control measures directly evaluates risk mitigation effectiveness by comparing the cost of a security control against the magnitude of risk reduction it delivers. If a control's cost exceeds the expected loss it prevents, the mitigation is not effective, making this cost-benefit comparison the essential tool for determining whether risk management actions are working as intended.

An updated list of vulnerable systems characterizes the current risk exposure rather than evaluating the effectiveness of mitigations that have already been applied.