During the course of a risk analysis your IT auditor identified threats and potential impacts.

 Risk Analysis Process:

After identifying threats and impacts, the next logical step is to assess existing controls to determine their effectiveness in mitigating identified risks.

 Why This is Correct:

Evaluating controls helps identify gaps or weaknesses requiring further mitigation.

 Why Other Options Are Incorrect:

B. Disclosing to management: Premature before evaluating controls.

C. Identify information assets: Should occur earlier in the risk analysis.

D. Assessing risk processes: A broader task, not specific to this step.

 References:

EC-Council highlights the importance of evaluating existing controls as part of the risk management process to determine residual risks.