risk assessment software engineering