how to evaluate basic portfolio risk