risk management assumptions