What you have is a valid object, there's nothing JSON about it, it's an instance of the core stdClass class of PHP. If you want to use it (for example get list the risk_challenge values) simply write:
foreach ($obj->risk_challenge as $value)
echo ' *> ', $value, PHP_EOL;
Job done.
If you want to convert the object to an associative array, you have 2 options:
$array = (array) $object;//a simple cast
$array = json_decode( //decode with assoc argument = true
json_encode(// but first encode it
$object
), true);
Why would you use the second version instead of the cast? simple: A cast is shallow (if any of the properties/keys contains another object, it will not be cast to an associative array, but it'll remain an object. json_decode does work recursively. In your case, though, I'd stick to the cast.
stdClassis a bona-fide PHP object, which you can iterate over, or access its members directly ($obj->risk_challenge[0], for example)