Identify and document the actual and potential impact; for example, through root-cause analysis.

paper

Document the control weaknesses, and resulting threats and vulnerabilities.
Identify and document the actual and potential impact; for example, through root-cause analysis.
Provide comparative information, for example, through benchmarks