Don't outsource risk management to regulators Solvency may be enough to please them, but it won't please shareholders