A State-of-the-Practice Survey on Risk Management in Development with Off-The-Shelf Software Components