Which of the following should be determined while defining risk management strategies?