Which of the following lists are valid data-gathering activities associated with a risk assessment?