Incorporating strategic risk into enterprise risk management