Best practices for identifying and classifying risks