The problem with risk management is the tendency to do nothing useful for a long time, before suddenly deciding to panic.