A risk profile is drafted, identified deviations are recorded and a report is prepared.