how to identify risky business assumptions