https://riskacademy.blog/are-risk-committees-useful/