A risk assessment must include the following:

• Identifying risks
• Assessing risks
• Controlling the risks
• Recording the results
• Reviewing and updating controls