Analysis of five large budget organisations (including three ministries) to assess the regularity and completeness of risk management. The analysis is carried out based on actual documentation demonstrating risk assessment and other related procedures during the last calendar year or later. For each of the following three criteria, 1 point is awarded (total of 3 points): • Risks are assessed at least annually in all five organisations; • All five organisations have agreed objectives and risk assessment is carried out against all the objectives of the organisation; • Risk mitigation measures and responsible persons are defined for at least those risks that have high impact and probability, and risk mitigation measures are reported at least annually in all five organisations.