What does a CRO do all day?

I'm late on the news that JP has hired a chief risk officer. (On the other hand it took JP a year to get around to it, so arguably I'm not the only one who is late.) Anyway, this brought to mind an old article of Rick Bookstaber's about what a CRO does. Bookstaber says in part:

What about the job of the risk taker? Well, a risk taker does, after all, take risk. He tries to do so intelligently, that is, he tries to put on positions that he hopes have a high return per unit of risk. But how much risk he takes and where he takes it has to be dictated by someone. You can’t just say “take risk, and good luck”.

The job of the risk manager at these firms is to convey the risk parameters to the risk takers, to define the boundaries.

I'm not sure that I buy that as the complete job description. To me it smells too much of risk measurement plus limits. Where is the risk management? Surely a CRO should be involved in advising the board on the firm's overall risk appetite, its macroscopic risk position, and capital allocation. He or she isn't just a goto person for yes/no decisions on positions the traders like: they should be proactively working with the Board to tailor the firm's risk position to optimise ROE and protect shareholders.