Most companies think about risk management after an incident happens. The smartest organizations think about it much earlier — during the hiring process.