It examines assets, vulnerabilities, threats, and the likelihood and impact of each possible event. The goal is to identify where to invest time and resources for the greatest effect.