Supplier risk and resilience assessment