When developing a new risk register, a risk practitioner should focus on which of the following risk management activities?