What are some benefits of implementing a risk management assessment for a device? Give the pros and what can be seen as potential cons if there any?