Open Question: How do insurance companies determine risk?

Are the obligated to tell the consumer why his or her risk is that high? Also, what are some illegal methods of determining risk ?