In Congress, corporate treasuries and regulatory agencies, smart people are trying to resolve the paradox of risk management. The economic crisis certainly exposed excessive risk taking and the need for better risk management, yet it was ostensibly more sophisticated risk management strategies and tools that increased risk and brought on the crisis.

In theory, sophisticated models reveal and can reduce risk. In practice, we now know that such models engendered false confidence that risk was being micromeasured and micromanaged, making it safe to take on more risk, explains Dan Borge, a director in the New York office of consultancy LECG and formerly the main designer of the first bank enterprise risk management system.

Borge built the computerized risk-adjusted return on capital (RAROC) model while working at Bankers Trust in the 1980s. In hindsight, he says bank risk models had two flaws. Some of the banks' products became more complex than the models were able to measure. More significantly, the models relied on historical risk data, and what happened in 2008 fell well outside historical norms.