The path to a risk register that reflects credible and up-to-date- state of risks is a long and demanding one. However, it usually begins with