single source risk mitigation