how to start risk management explained