A risk assessment must include the following: Identifying risks Assessing risks Controlling the risks Recording the results Reviewing and updating controls
