5 steps to determine residual risk during the assessment process