What information should an IT system analysis provide to the risk assessor?