"In order to manage risk, we must first understand risk."