move riskreference from ui to server