A Theory of Enterprise Risk Management