supply risk assessment