Which of the following should be the risk practitioner’s PRIMARY focus when determining whether controls are adequate to mitigate risk?