Risk criteria need to be established to judge the acceptability of risk. These criteria provide a benchmark against which the level of risk can be compared to determine if it is acceptable or requires further action. Therefore, the establishment of risk criteria is a logical objective of the RBI assessment if such criteria do not already exist within the user's company.