Just to address it, this just comes to my mind, but I'm not sure it will help you. The whole idea of risk management assessment is basically how you feel about something. Is it high-risk? Is it low-risk? What are the percentages? What do you think is going to happen? Invariably, a company wants it, it's not that risky, and we can do it. I'm joking. There are times when they do not, but rarely.
When they say “low-risk”, I have a strange feeling that maybe what they're talking about is under that process. At least that's been the case the times I've heard it. It's a feeling, not a number.