Lessons from the crisis: is a best practice model for risk management emerging?