Second-pass risk assessment