Building a solid risk management foundation is critical