Which of the following would be of GREATEST assistance in determining whether to accept residual risk of a critical security system?