GASB guidance expands risk-related reporting requirements