Risk is for everyone, not just management