https://aiss.co/issue-file-3-how-can-risks-be-assessed/