Three Steps for Assessing Risk