Why is risk identification and vulnerabilities to assets so important in risk management?