What are the two categories that risk indicators can fall into, and what are some examples of each?