5.1.1.2 Determine risk categories