Assessing risk using a risk matrix approach