Risk management planning begins with evaluating worst-case scenarios