Existing risk management practices are no longer sufficient. Simple tinkering with risk and control assessments and promoting the 3 lines of defence model will not deliver the resilience outcomes that we need to prevent the failures and blow-ups of the past.