process, residual risks are compared to gross risks for reasonableness. See Exhibit 8 for a graphical representation of this risk assessment.
The risks are rated based on the magnitude of the impact to the organization of the risk occurring, as well as on the probability of occurrence. Residual risk assessments are conducted through focused interviews with multiple levels of management, a review of business plans, analysis of financial and operational reports, and a review of miscellaneous information (e.g., industry information, etc.). For validation, the assessment results are discussed with the appropriate levels of management.