A risk assessment

A risk assessment must be carried only after a threat assessment is conducted.