Who should manage risk?