One of the recurring flaws of CBA's banking practice identified by John Laker's panel has been the "reactive" culture of its board and executives in managing risk.The panel found that CBA has been inclined to deal with issues only when they become problems rather than enforcing a risk culture that stood a reasonable chance of mitigating or preventing their occurrence.One of the most obvious shortcomings of the panel's report is that it seems to overlook the role that APRA's own policies and supervisory approach played in the multi-dimensional breakdown of risk management at Australia's largest bank.The panel's charge that CBA was reactive and complacent about risk management should also apply to APRA.Now that all the social and economic damage has been tallied, the prudential regulator has decided to take only belated and limp action.Laker's panel mostly examined how CBA was managing non-financial perils, such as operational risk, compliance failures and conduct risk.The panel concluded that CBA's systems were deficient.However, throughout the last decade CBA and the other major banks earned special capital concessions from the prudential regulator in relation to operational risk.It was APRA that decided more than a decade ago that the four major banks had demonstrated an "advanced" capacity to handle operational perils. And until this week the regulator's assessment was that CBA's risk management systems were superior to those of small deposit takers such as credit unions and regional banks.While the complexity of securing advanced accreditation for managing operational risk proved too big a challenge for smaller institutions, Laker's panel failed to recognise that such risk failures have been more frequent and disruptive at the major banks, especially CBA.Despite the evidence of one operational failure after another, since 2008 APRA continued to view CBA as a more competent risk manager than most other ADIs.The regulator believed so much in its accreditation testing that it saw fit to penalise small institutions for each home loan they wrote.Every ADI who supposedly could not measure up to APRA's advanced test was automatically deemed ineligible for a capital discount on their mortgage books.Those discounts, of course, were reserved for major banks like CBA that continued to hold advanced accreditation even as their businesses were tripping into scandals involving misconduct, fraud, money laundering, liar loans, irresponsible lending and the rest of it. As APRA chairman until 2014, John Laker oversaw the implementation of some of these policy failures.Therefore, he naturally carried a conflict of interest into the panel that was appointed by his former employer.Nowhere in the Laker report is there a hint that perhaps the regulatory privileges bestowed on CBA might have contributed to its board's complacency on matters of risk management.The Laker inquiry turned up plenty of evidence of APRA alerting CBA to shortcomings in its compliance and operational risk management practices as far back as 2013.While the panel noted that CBA took too long to address the regulator's concerns, it did not ask why the prudential regulator failed to act earlier to withdraw the bank's advanced accreditation.Such an action