Risk management falls short