Contracting with Controllable Risk