Why should the people on the risk assessment team be different from the people responsible for correcting deficiencies