difference between risk management understanding basics