workstream risk analysis