risk reduction cycle