Boards want to know if they're less exposed than last quarter. Patching metrics aren't the solution