A framework for risk evaluation