Review of risks should include