On the Risk Exposure and Priority Determination of Changes in IT Service Management