Watch this video on YouTube
Where should a risk practitioner document the current state and desired future state of organizational risk?