Risk-management systems in financial institutions have come under increasing scrutiny in light of the current financial crisis, resulting in calls for improvements and an increased role for regulators. Yet such objectives miss the intricacy at the heart of the risk-management process. This article outlines the complexity inherent in any modern risk-management system, which arises because there are shortcuts in the theoretical models that risk managers need to be aware of, as well as the difficulties in sensible calibration of model parameters. The author suggests that prudential regulation of such systems should focus on failures within the financial firm and in the market interactions between firms and reviews possible strategies that can improve the performance of risk management and microprudential regulatory practice.