The identification and management of risk: opening up the process