How to conduct risk assessment