In order to determining a risk is under-controlled the risk practitioner will need to

A risk is considered 'under-controlled' if its current residual level exceeds the organization's defined risk tolerance. Therefore, to make this determination, the risk practitioner must clearly understand the established risk tolerance, which serves as the benchmark for acceptable risk exposure.

Monitoring and evaluating IT performance helps in identifying operational issues but doesn't, by itself, determine if a specific risk is under-controlled relative to tolerance.

Identifying risk management best practices informs how risks should be managed but doesn't directly help in determining if an *existing* risk is currently under-controlled.

Determining the sufficiency of the IT risk budget relates to resource allocation but is not the direct measure for assessing if a risk is currently exceeding acceptable limits.