identifying and mitigating business risks