project risk characterization