Risk assessment methodology