How do we determine the risk category?