CDOs and systematic risk: Why bond ratings are inadequate