Regarding Operational Risk Management, the vulnerability of an asset or are is determined by assessing all of the following factors, EXCEPT which one?