Here are examples of tools that may be useful with a risk assessment, said Kelly Sauders, a partner at Deloitte & Touche LLP. Impact criteria and vulnerability criteria help prioritize risks to include in your work plan.^[1] Impact criteria refers to the effect on the organization if the risk materializes. It could cost the organization a lot of money, affect its ability to operate or hurt its reputation, depending on the level of risk assigned. The analysis then incorporates vulnerability criteria, which gets at how vulnerable the organization would be if the risk emerges. Contact Sauders at ksauders@deloitte.com.