7. Risk quantification