The purpose of identifying risks and threats is to be able to counter these in order to minimise the consequences and, as far as possible, ensure continued operation of the entity. The risk assessment does not differentiate between risks and threats, as these two concepts are often closely related.
The risk assessment works with the concepts of risks and threats at the unit level, which means that each unit identifies the risks and threats that could affect the continued operation within its own area. In this context, it is important to recognise that these can be both services that you receive and services that you provide to others.