the risks are rated based on the magnitude of the impact to the organization of the risk occurring, as well as on the probability of occurrence. Residual risk assessments are conducted through focused interviews with multiple levels of management, a review of business plans, analysis of financial and operational reports, and a review of miscellaneous information (e.g., industry information, process documentation, etc.). for validation, the assessment results are discussed with the appropriate levels of management.