"Risk management is not about avoiding risk, but about understanding and managing it."