How to get risk appetite right for projects