A risk assessment should follow a structured approach.