The organizations that participated in our study found that conducting risk assessments, to determine the nature and extent of their improper payments, was an essential step in helping them focus on the most significant problem areas and determine what needed to be done to address the identified risks in those areas.