https://riskacademy.blog/four-things-every-risk-manager-must-know/