What steps would be used during the qualitative risk analysis process to provide input to the risk register?