Watch this video on YouTube
We have acquired a competing organization; Krzysztof and his team are working on the risk analysis for the applications they use internally. Which of these would he use as PART of his Qualitative Risk Analysis?