Establish who might be harmed and how in risk assessment