The barriers to enhanced risk oversight