if YOU were in charge of the risk assessment, in a medium size organization (say, 250-300 employees, with three sites), how would you go about assimilating the risks for the entire organization