Authority and responsibility in risk management