. . . "determining a risk assessment based at least in part on whether the entity is a member of at least one of the membership programs; and" .