Risk identification with 1-5 probability/impact scoring, response strategies, residual risk tracking, and periodic review.