Managing risk in distributed systems