By comparing the department’s incident action plans to what are considered commonplace and accepted risk management practices, the ISO can: