I started off putting all retail as high risk in a category called Cash Intensive - Retail with the highest risk code, but in reality alot of them don't bring in a lot of cash, so I recently created another category - Non Cash Intensive - Retail with a lower risk rating.
Of course, as Kaybee states, if any activity occurs such as increased cash volumes or suspicious activity, it would get kicked up to the higher risk rating.
Hope this helps you.