Risk analysis in theory and practice