Getting started with risk assessment: a few key questions