This paper suggests that devastating, but avoidable, organizational failures in the financial sector are often not so much a consequence of business risks but of an absence of business virtues in leadership cultures. The current focus on the importance of risk culture in good risk management practices seems to recognise this, but we suggest that the approaches to culture are often inadequate in two important respects. Firstly, they tend to fall back into a reductionist and mechanistic treatment of governance, without adequate appreciation of the firm as a ‘complex adaptive system’ needing to be addressed holistically with a conscious concern for its social purpose and the value of entrepreneurial activity. Secondly, its cultural model fails to distinguish the descriptive from the normative. It consequentially has no basis for the diagnosis of dysfunction, and the promotion of more ethical behaviour resulting in the piling up of regulations that can constrain both good and bad behaviours We suggest a virtue ethics framework that that supports aspiration to the virtues –particularly the justice and integrity that are missing from many organizational cultures. – while recognising the need for restorative justice because mistakes are inevitable.