“The description of the risk should include the main assumptions and mechanisms leading to the risk arising, the criteria likely to be affected, the phases of the project in which it is most likely to occur and notes on the consequences if it does arise.”