Supplier risk assessment and mitigation plan