 Thus, the IA practitioner does not seek to eliminate all risks, were that possible, but to manage them in the most cost-effective way.After the risk management plan is implemented, it is tested and evaluated, often by means of formal audits.The IA process is an iterative one, in that the risk assessment and risk management plan are meant to be periodically revised and improved based on data gathered about their completeness and effectiveness.