when should a risk assessment be carried out