In the wake of a series of risk management failures, regulatory and control functions are converging, as they must, but the systems need more work.