What is the MOST effective way to begin a risk assessment?

Reviewing the policy, objectives, mandate, and commitment to manage risk

Learning the organization's ability to accept and/or manage risks

Identifying the resources available to manage risks within the organization

Identifying the nature of the risks faced by the organization