Distinguishing Between a Risk and a Risk Source
Encouraging people to think about risk in the ways described here
exponentially increases the value of the information, because it
not only allows you to focus on real risks that can be quantified,
it gives you much more information to use when thinking about
creating the right level of controls.