1. Who owns it?

2. Why is it being used?

3. Who may be affected?

4. What risks and impacts have been assessed?

5. Which controls apply, and why?

6. What evidence shows those controls are working?

7. What changed since the last review?

8. Who accepted the remaining risk?

9. What happens when something goes wrong?