os7 risk assessment guidance