Supplier evaluation risk rating