I would tend to do this with a table rather than relying on a free-form typing.
For instance
Code:
tblVulnerabilityCategory
VC_ID VC_Description
1 Roofing
tblRisk
R_ID R_Description
1 Low
2 Medium
3 High
tblDifficulty
D_ID D_Description
1 Easy
2 Moderate
3 Super Hard
tblVulnerability
V_ID VC_ID R_ID D_ID
1 1 2 2
This way you have a defined structure you can change as need demands without having to edit your query every time a change is made. The added benefit being your update query then just becomes a lookup based on a choice from a combo box or other similar mechanism.