Preventing major accidents: Conditions for a functional risk ownership