Nine cognitive biases risk managers should know