Level 1, the lowest category, encompasses routine operational and compliance risks. Level 2, the middle category, represents strategy risks. Level 3 represents unknown, unknown risks. Level 1 risks arise from errors in routine, standardized and predictable processes that expose the organization to substantial loss.