The first step of the risk assessment process is generally to
◦ identify controls to reduce all risk to zero.
◦ estimate the exposure from negative events.
◦ identify the threats that the company currently faces.
◦ estimate the risk probability of negative events occurring.