Planning process of identification and risk assessment entities should answer the question regarding the scope of the whole undertaking. Does an entity want to have at once whole picture of the risk or prefer the gradual risk recognition, beginning those in the most critical areas? It is worth to consider also the scale of assessments of identified risks. Will the financial aspect be sufficient and comprehensive? Or maybe the entity should give thought to different assessment dimensions considering also who in the organization is the most appropriate to make such an assessment.

Implementing a number of projects in this area, KPMG developed a proven approach, which after adjustment for the specific circumstances and the size of the entity allows achieve results in a relatively short time.