The qualitative determination of risks that are material—that is, that
potentially can impact the organization's achievement of its financial
and/or strategic objectives. This is often done through structured interviews
of key personnel by internal (e.g., internal audit) or external experts. In
some cases, the organization's business process maps are used to guide the
risk assessment.