You need to understand the existing environment in order to properly protect a PC from the threats.  Therefore, you must develop a strategy to determine the threats and document your findings.  It is very important that the client understands the findings of your threat analysis.  The documentation you provide should clearly explain how you defined and determined the threats and explain what the threats are.