procurement risk mitigation