Use a Risk Map, Not a Grab Bag