As harmful as the financial crisis of 2007-2009 was, some organizations professed some benefits as a result; “we know our risks better,” “we can better manage risks.” Many of the organizations that hailed such positives undoubtedly had what would generally be considered sound risk management systems/practices (RMS). So, what happened? What prevented organizations RMS from perhaps better mitigating risk during the recent financial crisis than was the case? Said another way, “what are barriers to effective risk management?” This study proposes a risk governance framework (RGF) that helps distinguish phases of RMS, and is grounded in Risk principles versus a controls based foundation that many view as part of the current problem with RMS. Based on our survey of 41 Risk Managers (RM) and 96 Regulators (REG), we obtained perspectives on barriers to effective risk management including barriers to effective risk management leading up to the financial crisis of 2007-2009, the importance of Risk principles, and suggestions to improve the effectiveness of RMS. We also obtained RM and REG perspectives of the impacts to RMS from our banking environment providing a type of “insurance,” impacts to RMS due to perceptions of the state of the financial/economic environment, how complete must phases of RMS be, compensation practices and its impacts to RMS, and the notion of quantitative/qualitative methods in current RMS. Leading up to the financial crisis of 2007-2009, identified barriers to effective risk management include a lack of risk culture and under estimating risks. Some suggestions to improve RMS include improving the risk function and developing more dynamic, forwarding looking and preemptive risk management tools and techniques that blend quantitative and qualitative methods. The proposed RGF and the rich context on barriers to effective risk management obtained from our study may help practitioners and academia alike in considering ways to analyze and improve RMS.