key risk flags