It is not enough for a company to simply say 'there are risks but they are not our problem’.