5.1.1.1 Determine risk sources