 Next, the IA practitioner will perform a risk assessment for those assets.Vulnerabilities in the information assets are determined in order to enumerate the threats capable of exploiting the assets.The assessment then considers both the probability and impact of a threat exploiting a vulnerability in an asset, with impact usually measured in terms of cost to the asset's stakeholders.