Risk assessment and control