A practical risk management approach