How to structure your enterprise risk management system