Supply chain risk assessment framework