Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact?