Business risk is rising up the board’s agenda