Goal-driven risk assessment in requirements engineering