The risky business of risk assessment