How would you describe the risk if a company doesn't do penetration tests?

[Sebastiaan <littlebighuman () gmail com>]

I'm currently doing an audit. Part of the audit scope is to audit the
penetration testing methodologies that are used.

Now for the risk/control matrix I have to come up with a good
description of a risk of not having penetration tests done.

We had discussions like this before on the list, basically concluding
that pen-testing only shows you that that specific pen-tester can't
hack into/harm your systems, etc.

> From a complaince point of view they run the risk of not being
complaint (because of PCI, local law, etc) but I need a better, juicer
"risk" description ;)

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------