Sort:  

as long as there is enough valid, available data (possibly with an Oracle sitting on top), they could certainly do risk assessments as well