Identify commercial, operational, financial and regulatory risks, rate them and see what mitigation is missing.