How your organization starts its risk mitigation process depends entirely on the type of organization you are working in.