Inherent risk ranking-why bother?