Once the strategic objectives have been broken down into more tactical, manageable pieces, risk managers need to use the strategy document, financial model, business plan or the budgeting model to determine key assumptions made by the management.

Most assumptions are associated with some form of uncertainty and hence require risk analysis. Risk analysis helps to put unrealistic management assumptions under the spotlight.

Common criteria for selecting management assumptions for further risk analysis include:

• 
  
• The assumption is associated with high uncertainty.
  
• The assumption impact is properly reflected in the financial model (for example, it makes no sense to assess foreign exchange risk if in the financial model all foreign currency costs are fixed in local currency and a change in currency insignificantly affects the calculation).
  
• The organisation has reliable statistics or experts to determine the possible range of values and the possible distribution of values.
  
• There are reliable external sources of information to determine the possible range of values and the possible distribution of values.
  

For example, a large investment company may have the following risky assumptions:  the expected rate of return for different types of investment, an asset sale timeframe, timing and the cost of external financing, rate of expected co-investment, exchange rates and so on.

Concurrently, risk managers should perform a classic risk assessment (as per the process outlined in ISO31000:2018) to determine whether all significant risks were captured in the management assumptions. The risk assessment should include a review of existing management and financial reports, industry research, auditors' reports, insurance and third-party inspections, as well as interviews with key decision makers. 

By the end of this step risk managers should have a list of management assumptions. For every management assumption identified, risk managers should work with the process owners, internal auditors and utilise internal and external information sources to determine the ranges of possible values and their likely distribution shape.