4.  Develop risk criteria

This step involves deciding the criteria against which risk is to be evaluated and considering whether risk treatment is required based on operational, technical, financial, legal, social, environmental, humanitarian or other criteria.