There are two sections to this dissertation. The first is an arrangement and classification of the various types and classes of IT security assessment and testing strategies. This section continues with a proposed learning and development strategy for the IT Risk Assessor to develop their testing and assessment skills. The second delivers the results of a process of experimentation designed to quantitatively assess the variation across the classes and definitively determine if there was in fact a quantitative variation in the results achieved using the separate processes. In particular, this research was designed to test the hypothesis that white-box audit techniques and tools based external penetration testing differ quantitatively. The results of this experimental process demonstrate that there is in fact a significant variation in the outcomes and that an audit-based approach is far more effective of noting and finding a large range of systems vulnerabilities.