Risk officer liability