Are you sure this isn't a homework assignment? I can't believe anyone with an organisation would think a good way of assessing whether or not risk management is a good idea is to ask their niece to ask people's opinions on a totally non related forum.
In fact if she even remotely thinks that is a good idea I'd say she definitely needs a risk manager who would tell her it's not. Following advice from random people on a forum would open you up to a great amount of risk.
Sorry I'm not meaning to be snarky here but this isn't the place to ask. Google would be a much better starting point.
Bookmarks