Category software risk management cra