Supplier risk assessment framework