isk assessment benefits, best practices and pitfalls