A process to determine the cost or impact of an event or hazard that could pose a threat to the organization and then assign a level of probability that it will materialize. Based on a risk assessment, management can then develop procedures or controls that can reduce or eliminate the risk.