"Such evaluation starts by a consideration of inherent and potential risks based on geographic allocation and industry type and includes, when appropriate, questionnaires and local verications." (pg 4)