How we conduct risk assessments