Risk Registers: A qualitative look at a semi-quantitative tool