Qualitative risk assessment example