How to conduct a Business and Customer Risk Assessment