assessing client business risk analytical review techniques