Now is the time of year when many boards have to say something about the effectiveness of their risk management and control.  So it might be a good time for the board – or at least the Audit/Risk Committee – to stand back a bit and think through how it’s judging “effectiveness”.  We have plenty of ideas on what needs to happen and what shouldn’t – here are just a few.