What step is used to determine the likelihood of a risk occurring?