Risk management for the real world