risk analysis steps to assess and prioritize