“Risk management systems and controls may discourage or limit certain revenue-generating opportunities. Failure to ensure the independence of these functions from the revenue generators and risk takers has been shown to be dangerous, and this is something for which the board is accountable.”