Risk assessment

Understand exposure, controls and the risk that remains.