Company culture needs a risk-management approach