<p>Boards want to know if they're less exposed than last quarter. Patching metrics aren't the solution</p>