1. Enterprise risk identification, assessment & reporting