Why is risk management necessary to an organization?