What is the first step in risk assessment for Certified Medical Administrative Specialist professionals?