shifting from management of operations to management of risks