Aligning Risk Mitigation with Organisational Objectives