Making enterprise risk management pay off