The right risk management approach in the public sector