Which purpose of a security risk assessment is true?