• Risk identification
  • Risk assessment
  • Control environment