risk management subgroup of management, 2 assertions