Residual risk assessments are conducted through focused interviews with multiple levels of management,
a review of business plans, analysis of financial and operational reports,
and a review of miscellaneous information (e.g., industry information,
process documentation, etc.)