Help the board understand where the business is vulnerable, where controls end, and where exposure begins.