risk and risk mitigation