Risk and resilience priorities, as told by chief risk officers (by McKinsey)

CROs acknowledge that they need to spend more time considering “over the horizon risks.” This gap in thinking was brought into sharp focus by the heavy impact the COVID-19 pandemic and geopolitical tensions had on their institutions’ risk profiles—including second- and third-order effects—such as supply chain risk, inflation, and rising interest rates—which were not anticipated by most banking executives.

Institutions were little prepared to address these highly consequential risks. The failure goes well beyond risk functions, however. Many organizations used forecasting to develop market strategies, but this approach failed to pick up major reality shifts in the recent past—from the financial crisis of the 2000s to the pandemic to geopolitical realignments. Leading institutions are moving to scenario-based foresight to increase institutional resilience against over-the-horizon risks. The risk function can play an important role here in ensuring that the scenarios capture existing and expected risks, while aligning function priorities against scenarios.

In this area, risk leaders can focus on two important themes:

1. Risk functions need to develop more sophisticated risk-identification processes. New risks emerge quickly in this dynamic environment, so they need to be discovered fast, along with their potential impact areas.
2. Investment is needed in foresight tools, such as “nowcasting,” which can feed nearly live quantitative data to help define scenarios and understand their impact on the main metrics of the bank. The risk and resilience function, modeling the strategic institutional stance, can develop planning cadences in which scenarios and action plans are continually refreshed.

Where is risk management going?

CROs are seeing five main areas that are structurally evolving to shape risk management in the future.

1. Evolution of the three-lines-of-defense model

Expectations on the role of the risk function are changing, and greater collaboration is expected across the lines of defense. The first line of defense, the owners of particular processes and operations, are seen by CROs as becoming more proficient in risk management and therefore handling more risk-taking decisions, such as those entailed in underwriting, collections, fraud management, and, in some cases, designing regulatory models.

As a consequence, the three-lines-of-defense framework is evolving to refocus the risk function on typical second-line responsibilities, including appetite setting and monitoring, policy setting, the challenge role, and second-line controls and reporting. To be effective in its second-line role, the function should be stepping up its competence in new risk types arising in the domains of cyber and tech security as well as climate change.

Almost all respondents to our survey said that for financial risks, the delineation of roles and responsibilities between the first and second lines is clearly defined and well understood in their organization. The divisions are less clear for nonfinancial risks, however.

2. Digitization: New technology, tools, data, and an ‘old’ issue

The risk function can rely on new technologies, tools, and more data, even if some of these building blocks retain “old” issues. For example, new internal and external data and new technology, including AI, can improve the quality of risk monitoring and decision making, with early warning systems and real-time controls. Here, the digital transformation, highly valued by all responding CROs, is expected to improve the basic efficiency of the function.

Many CROs believe, however, that they will continue to be affected by the old issue of poor data quality. As previously mentioned, more than half of respondents (58 percent) believe that advanced-analytics applications will be negatively affected by data issues, especially poor data quality. The vulnerabilities can be addressed by exploring and developing new types of algorithms to improve the quality of risk decisions. The effort can be supported by an analytics center set up within the bank.

Reporting and monitoring, a core responsibility of the risk function, remains excruciatingly difficult, prone to manual intervention, and burdensome in most institutions, despite almost ten years of costly interventions after BCBS 239.¹ Improvements are therefore sorely needed. Digital budgets have already grown significantly in recent years, however. Only 25 percent of CROs foresee an increase in the share of budget dedicated to digitizing activities. This means that needed improvements in reporting and monitoring will have to be achieved largely through improving risk-function efficiency.

Most CROs see existing digitization resources as the means to gain efficiency in traditional risk areas as well, especially credit risk, which will attract the bulk of investments, as credit decision making is digitized and the controls are automated.

3. Regulatory expectations

Prudential regulation is already having a significant impact on banks’ market positioning and risk agenda. These effects are expected to retain their strength (or grow in importance) in the next three years.

New regulatory areas, including refinements to existing regulation, continue to emerge. AMLA, the European Union’s new anti–money laundering authority, for example, will become operational in 2023. It is expected to pursue regulatory harmonization across borders, which will affect banks’ coordination and supervisory responsibilities. This move is in line with the general regulatory push for consistency in policies, tools, and risk decisions in complex institutions, along with the ability of those institutions to perform global oversight.

While retaining focus on existing regulation, CROs are closely watching the development of climate and environmental, social, and governance (ESG) regulation, which is set to evolve and tighten in the next three years. CROs believe that climate and ESG will soon be among the main regulatory themes affecting the financial-services industry.

Banks have been prone to poor regulatory remediation processes. In response, risk functions at leading institutions are seeking to build best-in-class processes, specialized skills, and organizational models needed to lead regulatory projects. In particular, attention is being given to agile ways of working. Overall, early and proactive engagement with regulators is the most important means to achieve alignment of regulatory demands with compliance and control strategies.

4. Market shifts and new risk priorities

Banks are coming under increased cost pressures as risk levels could rise in the short term. Low-cost market entrants, such as fintechs, are challenging business models. CROs are about evenly split in their expectations on the size of future risk budgets. Most of those who see a reduction in real spending are from banks that are leading in the digital transformation of the function. These institutions are driving cost reduction programs at the group level. Most CROs expect risk budgets will reflect shifting priorities and maturity in managing the different risks. For example, risk professionals have observed a 5 percent decrease in credit risk over the past two years; conversely, they expect certain risks to rise in importance, including model risk, climate risk, and technology-related risks. Such changes tend to affect the risk skill mix rather than the size of the function.

5. Creating and demonstrating value as a risk function

Historically, the risk and compliance functions in banks have focused on defining frameworks and establishing standard risk processes and governance—such as those around risk identification and assessment, monitoring and reporting, and remediation. Now, leading organizations are starting to focus on the value that those functions can and should create. This helpful shift moves attention and resources from more bureaucratic, documentation-oriented exercises to execution and business outcomes. When properly carried through, the focus on value becomes a powerful lever for business simplification, helping to rationalize processes and controls, reduce unprofitable products and services, and consolidate risk assessments. The path ultimately supports better institutional performance, including fewer losses experienced and reduced capital requirements for potential large, idiosyncratic events. Successful institutions able to focus on positive outcomes are more productive and more responsive to all stakeholders—customers, investors, and regulators.

CROs’ future priorities

CROs are preparing for the future by leading a number of long-term efforts simultaneously. They are seeking to deepen and accelerate the digital transformation of the function, to win the war for risk talent, and to build state-of-the art expertise in regulation, cybersecurity, analytics, and digital innovation. Rather than seeing fintechs and other new entrants as adversarial threats, for example, forward-looking risk leaders are embracing the new approaches. They are designing digital and lean transformations within the bank to become catalysts for innovation, possibly including partnering with fintechs. Those efforts are ongoing even as risk managers address more immediate macroeconomic and political disruptions.

Clearly, in this period of economic crisis and change, risk capabilities are needed more than ever. The needs grow in the areas of digital processes, with strong analytics and data control. Equal attention must be given to the “hard” components of these changes—analytics engines and data infrastructure—and to the “soft” ones as well—the upskilling of people.

The CROs of leading banks are increasingly seeing the risk function’s role as central to institutional strategy and resilience building. Progress toward this shift—to a holistic resilience function with a strategic role—has accelerated under the stress of simultaneous crises. Risk is able to anticipate evolving trends in the economic and regulatory environment and identify emerging threats. Foresight in traditional focus areas for banking as well as in newer topics such as ESG, cyber, and geopolitical changes creates potential first-mover advantages. Only by locating risk within institutional strategy will banking CEOs and CROs be able to exploit such valuable intelligence. In times of crisis, resilient organizations find the ways to make consequential moves early and accelerate into the new realities. As conditions improve, they can shift into growth faster than those they left behind.

ABOUT THE AUTHOR(S)