Which is the first step in a community risk reduction program?