A risk assessment is carried out by a team of people who have knowledge of specific areas of the business.
Risk: is the likelihood that something bad will happen that causes harm to an informational asset (or the loss of the asset).
Vulnerability: is a weakness that could be used to endanger or cause harm to an informational asset.
Threat: is anything (man made or act of nature) that has the potential to cause harm.
The CISA Review Manual 2006 provides the following definition of risk management: "Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization."[