How is the risk register used in the ‘assess – estimate’ step?