Making enterprise risk management pay off · Study