True statements about risk management