Risk management is a tool for strategy, not just compliance -