https://riskacademy.blog/do-companies-even-need-a-risk-manager/