contract risk assessment