Similarly, if they are not aware of the risks associated with their organization's information resources, they may not understand the need for and support compliance with policies designed to reduce risk.
If they don't understand the risks associated with their organization's information resources, they might not understand the need for policies that reduce risk.