Roles and responsibilities of risk management department