This study evaluates the capability level of IT risk management processes at BPKP South Sumatra Province based on the COBIT 5 APO12 domain. Data were collected through interviews and questionnaires covering activities APO12.01–APO12.06. The results indicate that the current As-Is capability is at Level 3 (Established Process), meaning the risk management process is defined and consistently executed but still requires improvement in monitoring, mitigation reporting, and risk evaluation. The To-Be condition is set at Level 5 to achieve more proactive, effective, and sustainable IT governance practices.