risk management implementation lessons learned and challenges