Which of the following is the MOST relevant input to an organization’s risk profile?