risk management methodology factors