Diversification is the only free lunch on risk management