What are we doing when we think we are doing risk analysis?