‘Boards should explore ways to bring risk evaluation into all aspects of the business and build agility into management culture’