facility risk rating