Designing for a more effective risk management function