What you need to know before you start the risk management process.