name two items covered in a risk management statement