Risk Identify - The risk must first be identified before it can be assessed, andresponses planned and then implemented.