The external auditor has recommended that the organization implement a risk management program. The organization's employees have no experience or formal risk m...