Which of the following must be included in a risk statement?