We show that installing stronger risk management into financial institutions—a proposal widely discussed following the 2008 financial crisis—is insufficient to constrain institutions’ exposure to investment with lurking risk, such as asset-backed securities (ABS). Regulations affect the functioning of risk management: risk management constrains institutions’ exposure to risky ABS when they face mark-to-market reporting combined with capital requirements; however, this role is considerably weaker when capital requirements are combined with historical cost accounting. We find suggestive evidence that financial regulations affect risk management functions through promoting risk managers’ efforts in uncovering ABS risk and curbing executives’ incentives to take excessive risk.