[ISO/IEC 27005:2008] Risk monitoring and review [SP 800-30] Evaluation and assessment [Risk IT] 
RG2 Integrate with ERM. RE2.4 Perform a peer review of IT risk analysis. RG2.5 Provide independent assurance over IT risk management