It is critical that legislators and regulators explain to the public what metrics are being used to determine whether indeed the bank has implemented the laundry list of promises to improve risk management. Mea culpas are insufficient without evidence of contrition that will help those harmed.