Running a risk system: moving from oversight