A common and clearly defined methodology is used to measure and evaluate specific risk events in terms of their impact, probability of occurrence and the level of adequacy of the control system in place.