Analysis of threats and risks should include
differentiating between a threat and a risk
identifying internal and external
rating them
reporting them to risk management.