Boards need education and awareness to be able to ask the right questions and oversight the risk effectively.