evaluating processes procedures and requirements for risk management scope