How boards can support risk-aligned strategy