According to ISO 14001:2015, when determining the risks and opportunities that need to be addressed, which of the following must an organization consider?