To carry out a Risk Analysis, you must first identify the possible threats that you face, then estimate their likely impacts if they were to happen, and finally estimate the likelihood that these threats will materialize.