Who Does What? Getting the Roles Right in ERM