A good risk manager first seeks to identify all risks, then eliminate and mitigate those practices that might give rise to a claim.