Which of the following is MOST important when discussing risk within an organization?