How new thinking in risk management could build organisational resilience