Which basis for prioritization allows the project team to work initially with lower-risk requirements first?