The risk associated with an asset before controls are applied can be expressed as: