risk mitigation in software engineering