Keep it simple to facilitate broad understanding of the OVERALL process. Too much detail early on can be overwhelming and/or lead to confusion. If you agree that more detail is required on a particular action, it is easy to highlight that box and produce a separate chart showing the process taking place within. Recommendation This activity can lead to feelings of hopelessness; it is important to remind the staff that any risk can be mitigated, and indeed it is the goal of an audit to identify the highest priority ones based on actual likelihood and provide guidance on mitigation. RISK MODELING USING THE PRE-MORTUM STRATEGY Summary The pre-mortum strategy was devised to take participants out of a perspective of defending their plans and strategies and shielding themselves from flaws. They are given "a perspective where they [are] actively searching for flaws in their own plan." 68 . Overview "Pre-Mortum" Activity Identification of critical processes Selected critical process mapping Threat Identification (Control/Confidentialy/Idenity/Integrity/Authentication/Access) Impact Identification Adversary Exploration (Likelyhood) Impact Ranking Materials Needed Stickies Whiteboard or flip-chart Markers Camera to digitally capture the data Considerations Page 142 of 240