Is a vulnerability and threat assessment a technical undertaking only, or should it consider other factors?

Is a vulnerability and threat assessment a technical undertaking only, or should it consider other factors?