“The purpose of risk management is to improve the future, not to explain the past.”