Risk identification and risk reporting as a value added process to drive decision making