IT Risk Mitigation is Still a Work in Progress