Key Question: Who should own risk management?