If risk teams are silent, it may not be because everything’s fine – but because no one handed them a mic.