What does a modern group risk strategy look like?