risk identification and analysis