Although there is much confusion around the role of the board in corporate efforts to manage risk, Holly J. Gregory argues that boards can cut through the fog by understanding the business and legal framework for their involvement in risk management.

Specifically, boards should focus on three key responsibilities:

- Understanding the risks facing the company as a function of strategy.
- Providing oversight of the processes put in place to identify and manage risk.
- Managing certain risks that only the board is positioned to manage.