SSCP - Risk Identification, Monitoring and Analysis - Risk review (internal, supplier, architecture)