What known problems and possibilities are there? What risks are there in the processes? How well do we meet the needs and demands of our interested parties? 

Identifying potential for improvements is easier if based on process models. The models make it easier to:
-point to problems
-risks
-possibilities.

Moreover, these can easily be documented and addressed to the correct receivers.

Identifying risks can be made based on different risk areas, such as personal security, work environment, information security and so on. Often existing standards are used as the basis for the risk assessment. Many standards also have questions and checklists as work material. The result is some form of GAP analysis. Risks are documented in the process models.