the creation of a multi-year plan structured over three years, with the aim of guaranteeing coverage dur ing the period of all macro-processes (identified by the Enterprise Model); the definition of a risk-based plan based on the potential risk identified by the Business Process Risk Assess ment or internal evaluations.