risk and vulnerability assessment