Risk management for public entities