Risk management isn't about avoiding risks—it's about understanding and mitigating them.