Depending on the results of this risk assessment process, they may decide that it is necessary to implement explicit risk management strategies. Each successive level builds on the results of the preceding one. The key question for them is what their risks are now and how these will evolve over time.