Common misconceptions in risk management