In many of the aggressive firms that got into trouble, risk management was used primarily for regulatory compliance rather than as an instrument of management control. At Citigroup, for example, risk managers sometimes reported to operational heads who were responsible for revenue, putting the fox in charge of the chicken coop.
