How do you prioritize risks when documenting and tracking remediation activities?