The risks are rated based on the magnitude of the impact to the organization of the risk
occurring, as well as on the probability of occurrence. Residual risk assessments are conducted
through focused interviews with multiple levels of management, a review of business plans, analysis
of financial and operational reports, and a review of miscellaneous information (e.g., industry
information, process documentation, etc.). For validation, the assessment results are discussed with
the appropriate levels of management.