At this stage, you should assess the likelihood that the organisation will be exposed to each specific risk, considering such factors as:
anticipated frequency;
the external environment;
the procedures, tools, skills currently in place;
staff commitment, morale, attitude; and
history of previous events.