Ask anyone about the causes of last year’s meltdown on Wall Street, and odds are they’ll nod wisely and murmur something about a “failure of risk management” by financial institutions.

The problem? That’s a partial diagnosis, at best, of what went wrong on Wall Street and why so many of the largest players in our financial system came so close to the edge of the abyss. A year after the bailout saved some of those firms from toppling over the edge altogether, the question is whether Wall Street has learned any of the real risk-related lessons of the events of 2008.

Risk is what Wall Street is all about. In the aftermath of the last two years or so, the level of fear still remains high, even as risk taking, by some measures, is beginning to return to Wall Street. (Just look at the jump in risk that Goldman Sachs’ trading desk is taking, as disclosed in its financial results.) But that’s just as it should be—as long as risk is properly priced. Wall Street’s role is about taking risk and transferring risk. If regulators and legislators create a “risk crunch” on Wall Street, the impact could be just as devastating as any credit crunch for users of the financial system.

VaR is just a number—but it’s still a useful number. No alternative to the much-maligned value-at-risk methodology has come along as a way for a financial institution to calculate how much it stands to lose on a given trading day over a certain time span. That’s just fine, says Marcus Cree, director of North American solutions for sales at trading at SunGuard, “In the absence of catastrophic failure, a single number gives you a way to think about what risk you are taking, and it’s just as valid and important as it ever was” for anyone trying to get a snapshot of how much risk they are taking.

Any risk model—like VaR—is just a starting point. The problem with VaR—or any model that someone in decades to come dreams up to replace it—is that it’s an absolute number. The only way it becomes understandable and helpful is when it’s put in some kind of context. It’s one thing for a financial institution to say, "OK, this tells me that I will lose at least $80 million at least once in every 100 trading days." It’s something else again to use that as a starting point for a deeper discussion about what might happen on those days when losses do exceed that level. A VaR number should be a way to trigger debate about the risk associated with that "tail." “There is, I am glad to see, a lot more discussion and work happening in what is called conditional VaR, where people look more deeply at those 1-percent scenarios and try to detect any patterns to develop a deeper understanding of the possible events that could trigger a very large loss,” says Jaidev Iyer, the managing director of the Global Association of Risk Professionals and a former Citigroup risk manager. That tells him that some people on Wall Street are paying attention to the right kinds of questions and are aware of VaR’s limitations.

Risk models can set up perverse incentives. A trader who is handed a VaR limit and told he can’t exceed it is being given an invitation to take foolish risks, remarks Iyer. “They have an incentive to game the system, to say to themselves, I will maximize my actual risk and stay within VaR.” That is a problem that becomes particularly acute when liquidity suddenly evaporates. Up until then, an illiquid portfolio and a liquid one can have identical risk profiles, since risk models don’t capture the dangers of markets suddenly becoming illiquid. The return offered on the illiquid portfolio tends to be higher, tempting a trader to take risks (whether consciously or unwittingly) that aren’t reflected in VaR and that rigid VaR limits can exaggerate. Similarly, allocating those budgets puts traders in a position where they may feel required seek out risk in order to meet their risk budget. If their returns don’t measure up, and their bosses realize that they haven’t been taking enough risk, that could be worse for their careers than if someone had underperformed because of losses incurred while making full use of their risk budget.