Managing incomplete knowledge: Why risk management is not sufficient · Study