risk responsibility