One of the problems with many risk management functions, as I see it, is their reporting structure. The ideal is viewed by many (including regulators) as reporting directly to the board or a committee ...