Managing Risk by Segregating Duties