3 main types of risk assessment