Which of the following is MOST important to the successful development of IT risk scenarios?