Four steps for reducing project risk