Faced with the need to deliver risk ratings for your organization, you will have to substitute the organizations risk preferences for your own. For, indeed, it is the organizations risk tolerance that the assessment is trying to achieve, not each assessors...
