Start with the real job
Build a risk register with likelihood, impact, exposure, owner, mitigation, contingency, trigger, review date, filters, and heat map. Supply the current process and source records, field definitions and responsible owners, exceptions and escalation rules and identify anything the Agent should ask about first.