Categorisation and formulation in risk management