How to measure risk?