When it comes to the harder edge of regulatory investigations, one small group has the power to cause issues that go far beyond the boundaries of conventional risk governance. The challenge for the regulator in these exceptional cases is to keep regulatory judgement and organisational resilience separate. The answer is not to create an entirely new risk governance framework. Instead, supplement the existing framework with a sequence of four additional considerations.