“Strategic risks are determined by board decisions about the objectives and direction of the organization. Board strategic planning and decision-making processes, therefore, must be thorough.”