Risk identification using a well-structured systematic process is critical, because a risk not identified at this step is likely to be excluded from further (timely) analysis and treatment. Identification should include risks that are not under the control of the organisation, as well as those that are.