The risks are rated based on the magnitude of the impact to the organization of the risk occurring, as well as on the probability of occurrence. Residual risk assessments are conducted of financial and operational reports, and a review of miscellaneous information (e.g., industry information, process documentation, etc.). For validation, the assessment results are discussed with the appropriate levels of management.