risk management questions