Bank risk appetites and profiles are not fixed. Rather, they are procyclical, and continue to grow as memories of the crisis fade.

This shift frequently goes unnoticed by boards, regulators and shareholders, given the opaque nature of banks with hard-to-value assets, voluminous financial reports and multiple subsidiaries. The increase is reinforced by the killer "B's" of budgets and bonuses, which makes it difficult for management to resist higher risk. Recent examples include growing second lien and covenant-lite leveraged loans and the return of commercial real estate lending. Bad information combined with bad incentives leads to bad results.

Each success or near-miss justifies the behavior and encourages further adventures. The absence of evidence of loss is taken as evidence of absence of loss. The cumulative small increases in risk taking become fatal, once luck runs out and adverse unlikely events eventually occur. This is a classic case of regression to mean, which is more reliable than the extrapolation from recent events. The result is that decisions leading to disaster are not made based on evil intent or stupidity. Rather, they are part of the boiled frog syndrome.

A frog placed into boiling water immediately jumps out. The same frog placed into a pot of cold water that is gradually heated fails to recognize the danger and dies. The same is true for banks failing to recognize the impact of a gradual rise in their risk profile.

The boiled frog syndrome is difficult to control. It was Cassandra's curse that she was right, but no one would listen. Institutions become comfortable with the nominal profit increases from higher risk and ignore the warning signs. It is hard to recognize a problem when you are paid not to see it.

Furthermore, the warning signs are frequently ambiguous and direct evidence is limited. Organizational bureaucracy complicates matters. Bureaucracies focus on process and not results. Conformity to rules overwhelms common sense. Consequently, the risk build continues without an obvious reason to change until it is too late. The problem is one of complacency, not black swans.

Strong active board oversight and due diligence by experienced independent directors with skin in the game are critical. Risk appetite changes should be fully debated based on a full consideration of the institution's strategy, ability to manage the risk and capital sufficient to absorb higher losses.

This form of preventive risk management does not come naturally. It requires scrutiny of growing businesses with high returns to ensure they do not involve the possibility of fatal losses. Consequently, determining whether the results are due to skill or unmeasured risk is needed. Eventually, the heightened risk may require a portfolio rebalancing to bring the risk profile within established risk appetite limits, even if it means sacrificing short-term market share.

A risk governance framework to avoid the boiled frog syndrome includes four principles. First, accept only those risks you understand. Know the fatal flaw in every investment.

Next, if you can make money, then you can lose money. Exceptional returns require holding exceptional risks or having the skills and resources to manage the risks.

Third, complex products are dangerous. They are embedded with difficult-to-see risks. Their true nature does not manifest itself until later. Thus, track records are of limited value.

Finally, avoid any single or groups of risks that could threaten solvency no matter how improbable. Risk measures based on past experience are static snapshots and not predictors of what could happen.

As Warren Buffett notes, risk comes from not knowing what you are doing. Thus, assets do not have risk – institutions do. Banks failing to distinguish the long-term effect of gradual risk level changes do not know what they are doing. They, like our hapless boiled frog, are likely to face an unpleasant future.

J.V. Rizzi is a banking industry consultant and investor. He is also an instructor at DePaul University Chicago.