To operate as true risk managers, MSPs must take deliberate steps that go beyond technical fixes. Here are some ideas.