What should be considered before I start the risk assessment?