The risk management process should be transparent, including identification and systematic documentation of all elements of the process, including decision-making.