"Major concerns" about risk management programs