Consequence management was more ideal than imperative at NAB in recent years, so beset by worry was the board of the bank "that you may have a part of the business in which serious problems are lurking."That was Ken Henry speaking - the chair of NAB making the most of his second day as a witness at the banking royal commission to serve the interests of the public and his depositors with yet more candour on the modern history of one of Australia's most troubled banks.Rowena Orr, counsel assisting, read out some choice quotes from a series of prudential reviews of NAB, by APRA, back in 2016. The litany of its concerns around NAB and the conclusions of APRA disclosed by Orr can only leave followers of the royal commission wondering; why was NAB at the time not castigated publicly and sanctioned more forcefully (in the manner of the coercion of Commonwealth Bank this year)?Orr outlined APRA's anxiety, quoting from a letter dated 28 April 2016 from APRA regarding its prudential review into risk governance matters at NAB:"For some time now APRA has had a view that NAB has been more vulnerable to breaches and prudential issues than peers. APRA recognises and acknowledges the positive steps that NAB has taken in recent years to strengthen its risk governance. "However, we are of the view that there is further to go. This has led to our focus on NABs risk governance framework this year."In summary, APRA requires that NAB develops and implements a plan to address the specific findings in the report and to achieve the following overall outcomes. APRA said NAB needed to develop: •    "an effective risk appetite framework that provides clear and prudent limits on management risk-taking and which is enforced through proactive management of the bank's risk profile; •    clearly defined roles, responsibilities and accountabilities for risk management; and•    monitoring and reporting at the board and management risk committee levels that provides comprehensive, transparent and forward-looking assessments of risks relative to risk appetite."Around this time NAB's CEO Andrew Thorburn was working extra duties as chair of the Australian Bankers Association, curating the sector's rushed and reactive engagement with the politics that eventuated in Kenneth Hayne's royal commission.Having received confirmation from NAB chair Ken Henry on her summary of APRA's position, Orr then demanded: "What changes did NAB introduce to address these issues?"A lot, was Henry's short response, to which he added a long coda:"There was a huge program of work that was implemented, Project Cornerstone. "Ultimately, the quality of the reports coming to the board risk committee contained a lot more detail, considerably more granularity, showing where various parts of the business were operating with respect to risk boundaries, where the gaps were, clearer definition of responsibilities … I think there are well over 100 risk limits that are identified now in the group chief risk officer's reports every month as a consequence of Project Cornerstone."Orr had even more compromising material, directing Henry to a second review