5.5.9.2 Identifying and analyzing risks