It is better to adopt a simple risk management process rather than to do nothing at all simply because the alternative looks too onerous