How to conduct a software risk assessment that is meaningful