component risk assessment