risk management in regulated industries