Things like: •  corporate governance  •  risk appetite;  •  risk management;  •  alignment of incentives to risk taking; and  •  organisational culture; are all important. Institutions that have, and effectively implement these things, are likely to be well-run and would portray a good grasp of their risk environment.
The government provides a safety net to banks in the form of deposit insurance, and in return, banks are subject to government oversight that mimics some of the monitoring that the private sector would provide, absent the government safety net.