Plan for the expected and unexpected: What you need to think about when completing a risk assessment