Roles and responsibilities of board of directors in risk management