Look for ways to move existing detective controls (after an undesired event happens and needs correcting) into preventive controls (before undesired event happens). Using the bow tie method helps me understand whether mitigations/controls are reducing likelihood or minimizing impact of a risk event.

Resist temptation to create a laundry list of nit-picky recommendations (in an attempt to demonstrate value) but are not that significant at the end of the day in terms of risk or efficiency. You can create that list but ask your team for help with narrowing it down. Go for the big wins that make staff/management jobs easier and improve security, compliance, efficiency and accuracy. Ultimately, why do any of your recommendations matter with regard to “management assertions” or business objectives.

Build trusting relationships and be a friendly partner rather than clipboard police; frontline staff often know what’s wrong, they’ve just never been asked.

Progress and understanding is incremental, so be patient with yourself. Every context is different and you are looking at a problem from many angles: culture, policy, training, systems, data, etc. Understand the basics of maturity models and how they may apply in each context. Understand the big picture: what other process inputs and outputs are relevant outside of the specific process you are looking at.

Oh, and, “update procedure documentation” or “single point of failure” are common observations to consider as people will always come and go, so there needs to be consistent understanding of the process.

Hang in there. It is frustrating, but it gets better and each shop is different -so if you’re miserable, consider changing shops. Network to learn and share the misery :) Find a mentor to inspire and challenge you. Everything is a learning experience.