“Shareholders tend to see the board’s annual enterprise risk assessments as tick-the-box exercises to meet stock exchange requirements. But if they are done well, they are foundational elements of being prepared.”