On the Use of Risk Assessment in Project Management1