A good risk management program involves: