The changing role of the board in risk management