How to conduct risk analysis