“Effective risk management depends crucially on establishing a reporting culture.”