tiered risk assessment