risk acceptance criteria