Risk-based Impact Assessments – Scripted vs. Unscripted Testing for Criticality