two classification of sources of risk