The process of finding, recognizing and describing risks. [Reference: ISO 31000]