You don't have a risk department.
You are the risk department.

In about five minutes, see the risks your business is carrying right now, and what to do about each.