Formalizing risk management throughout an organization