Mistake 1: Too selective risk analysis