Similarly , if they are not aware of the risks associated with their organization 's information resources , they may not understand the need for and support compliance with policies designed to reduce risk .
If they don 't understand the risks associated with their organization 's information resources , they might not understand the need for policies that reduce risk .