Quantitative risk assessment