Vulnerabilities are a key element in the conduct of a risk analysis. Audit planning consists of short- and long-term processes that may detect threats to the information assets. Controls mitigate risks associated with specific threats. Liabilities are part of business and are not inherently a risk.