Be creative, but realistic: Describe an example (of your own creation) of a business. Be brief, but clear. If you have a part-time job or a family business you could describe that business. If you don't have any direct experience of a business from the inside, that's ok -- you're interacting with businesses all the time, so you can choose a business that you are a customer of and describe it. Now develop a sample risk control spreadsheet for assets and threats that you can identify or imagine in your described business. The spreadsheet doesn't have to be complete, but it should be representative or a wide range of concerns.