"a risk assessment based at least in part on whether the entity is a member of at least one of the membership programs; and" . . . .