Assigning risks