Risk assessment: Not a tick box exercise