Dealing with the "don't know" answer in risk assessment