"If you don't invest in risk management, it doesn't matter what business you're in, it's a risky business."