Vulnerability assessment, both internal and external, and Penetration test are instruments for verifying the status of security controls.
The attitude of involved people to benchmark against best practice and follow the seminars of professional associations in the sector are factors to assure the state of art of an organization IT risk management practice.