To communicate the risk associated with IT in business terms, which of the following MUST be defined?