and risk mitigation are often inadequate