Risk analysis

How is a risk analysis documented for the supervisory authorities?