calculating risk