In performing a risk assessment, management should consider all significant interactions between the entity and other parties, as well as all internal factors at both the organizationwide and program levels.