Question 3 – Evaluating and prioritizing risk