Some areas of improvement were identified in terms of the alignment of risk identification processes and perceptions, the understanding of inherent and residual risks, and the use of risk management tools.