The first step of SPA is brainstorming to identify risks through the use of multiple brainstorming groups