Why you’re terrible at calculating risk