Financial firms have made some progress in developing risk appetite frameworks and building their information technology infrastructures in the wake of the global financial crisis, but they have “considerably more” work to do to strengthen these practices, according to a group of global financial regulators.