The first question the risk oversight process seeks to answer is, “What are our most critical risks?” An effective risk management process lays the foundation for management to respond to this question confidently as the business environment remains in a constant state of flux. This publication lays out the key items to consider when conducting an enterprise risk assessment and suggests some questions for boards to consider when they evaluate their confidence in the organization’s risk assessment process.