Assessment of risks and capital allocation remains inconsistent and uncommon, writes Genevieve Redgrave