According to Isaca COBIT 2019, the primary objective of preparing a risk profile is to identify areas of risk that exceed the risk appetite of the enterprise. This involves assessing the potential risks that the enterprise is exposed to, and determining if these risks exceed the level of risk that the enterprise is willing to accept. This helps the enterprise understand and prioritize the areas of risk that need to be addressed, and helps to ensure that appropriate measures are taken to mitigate these risks.

Performing a due diligence review following a merger, acquisition, or divestiture is critical to ensure that the new organizational structure is well-thought out, secure, and compliant with applicable regulations. The review should include an evaluation of the organization's IT assets, processes, and policies to ensure that they are appropriate for the new organization. Additionally, the review should evaluate the IT security and data privacy requirements for the new organization, as well as the potential impact of the change on the organization's IT services.