They also categorize into three piles: low, medium and high risk user stories. The following is an example of an approach to this: Determine Risk Index: Give each user story an index from 0 to 2 on each of the following factors: