Supply-chain risk management