How to measure and communicate risk