identify requirements and risks