This paper extends Ellul and Yerramilli’s (2013) risk governance index for U.S. banks to international banks across 33 countries, using that index to examine relations between national codes of governance, individual bank risk governance and both risk and performance outcome measures in periods before, during and after the financial crisis. We focus on the post-crisis experience, and whether banks have learned from that event. During the crisis, it appears that banks were locked into positions regarding risk that were determined by their prior risk governance policies. This had several consequences: risk-taking during the crisis was related to prior risk, and prior risk governance, and better governed banks experienced poor performance, particularly during the crisis. However, since the crisis period, risk governance policies have been less influential, and we find no relation between prior risk governance and risk, which supports the argument that banks have not learned lessons from the financial crisis. The importance of both taking risk and managing those risks well is highlighted by significance of the interaction term between risk and risk governance during the crisis and over the whole period of the study. These results will be useful for bank regulators and bank managers.