Using FMEA to assess risk