Risky business: Establishing quality risk assessments