risk assessment case study