Security risk management is the ongoing process of identifying and mitigating security risks. Risk is calculated by taking into account the likelihood that known threats will exploit vulnerabilities and the impact on valuable assets. Risk management also includes monitoring risk indicators to identify potential problems before they become critical issues. Risk assessment is the first step in risk management. It determines what risks exist within an organization and what degree of exposure those risks pose. Risk assessments should be conducted for each project that the organization undertakes. The next step in risk management is risk identification. This involves listing all the risks that have been identified during the risk assessment process. Risk owners are then assigned to manage specific risks. They work with other members of the management team to determine how risks may be controlled or prevented from occurring. Risk mitigation involves taking action to reduce the probability of a risk occurring or the severity of its effects if it does occur. Prevention is the best method of reducing risk, but sometimes prevention is not possible so management should try to minimize the damage done by remediation methods such as surveillance, testing, and audit trails. Managing risk requires balancing the need for increased security with the cost of doing so. Risk-averse individuals may choose to avoid certain risks by moving data centers to remote locations or using low-security systems, for example.