The risk function assesses and monitors the risks taken, and gives advice about the risks of complex transactions. Over the long run, if the risk function underperforms, only luck can save the entire bank from underperforming.
Yet managing the performance of the risk function is difficult because its performance cannot be readily observed. Banks must instead rely on indicators that should correlate with performance. And they must employ incentive schemes that encourage good performance of the risk function, which at its core is often unobservable.