Exemptions, Risk management processes, Risk Management