Risk Management -- Should The Board Get Involved?

It's the board's job, not management's job, to say if they are willing to take a certain amount of monetary or reputational risk in any given area. It's management's job to figure out how to do the business and set the strategy.