Which quadrant should be the focus of risk management?