How to conduct comprehensive risk assessments