Identification could include
- assessing risk by identifying and prioritizing risks to the business
- conducting decision support by identifying and evaluating control solutions based on a defined cost-benefit analysis process
- implementing controls by deploying and operating control solutions to reduce risk to the business
- measuring program effectiveness by analyzing the risk-management process for effectiveness and verifying that controls are providing the expected degree of protection
- enhancing instructional resources.