Why a Risk Assessment is NOT Enough