December2025

Mckunsey

&company

Risk&ResiliencePractice

Thefutureofrisk:Howglobaltrendsare

reshapingrisk

management

Arapidlyshiftingandinterconnectedrisklandscape,technology,andAI

transformwhatgoodriskmanagementlookslike.Financialinstitutionsmustembracenewoperatingmodelsandbestpractices.

byAnkeRaufuss,ArvindGovindarajan,IdaKristensen,andThomasKelepouris

Greatriskmanagementhasneverbeenmoreimportant.Consideringcyberattacks,politics,

andtradewars,financialinstitutionsrelymorethaneverontheirriskleaderstonavigate

uncertainty.Butastheworldchanges,sotoomustriskmanagement.Notonlyarerisks

proliferating,butsoaresolutions.InanAI-empoweredfuture,newskillsandcapabilitieswillberequired.Riskfunctionswillneedtobemoreagile,morecross-functional,andmoretech-driven.Inthenextthreetofiveyears,executives,startingwithleadersofriskfunctions,mustembracetransformationandstarttoimplementtherequiredchanges.

Forcesatplay

Asriskleadersfocusonbuildingtheriskfunctionsofthefuture,whatforcesshouldshapetheirthinking?Weseefivethathaveprofoundimplicationsforrisk:

Geopoliticalfluxasthenewnormal.TheWorldUncertaintyIndexisnearlyninetimeshigher

thanitwas20yearsago,reflectingallthegeopoliticaldisruptionsofthepastfewyearsaswellasthenewnormalofgeopoliticaluncertainty.1Globalsupplychains,capitalandtradeflows,

cyberattackpatterns,andshiftingdomesticpoliciesarefeelingtheeffectsofthisuncertainty.Inresponse,riskleaderswillrequiremoredynamicandforward-lookingplanningandforecastingframeworksflexibleenoughforrapidlychangingenvironments.Activitiessuchasstress-testingwillalsoneedtobemoredynamicandconsiderabroadersetofpossiblescenarios.Risk

managerswillneedtohavetheirfingeronthepulseeverydayandhaveaccesstostandingandresponsecapabilitiesmoreagilethantheadhoc“warrooms”ofthepast.

Technologicalprogress.DigitalcapabilitiesandAIarecreatingbothopportunitiesand

challengesforriskmanagement.Inonboarding,transacting,andborrowing,almostevery

customerjourneyisbeingreshapedbydigitalization.AIisreformingthefraudandcyberthreatlandscape,andcontagionriskhappensfasterthanever.Thisrequiresaccesstonear-real-timedataandanalyticsaboutopportunitiesandthreatscreatesadifferenttalentmixtomanage.

Furthermore,webelievethatfinancialinstitutionshavetorethinkriskappetitestatementsandframeworksfornonfinancialriskssotheycantodevelopmoreappropriateriskmetricsto

monitoradigitallyfast-movingworld.

Interconnectednessofrisk.Connectedprocessesandinfrastructureleadtohigherlevelsof

dependencyandincreasedlikelihoodofriskcontagion.Considerhowgeopoliticaleventsdrivesupplychaindisruption,whichleadstocreditdeteriorationandspikesinbondyields,orcyber

eventscausemanufacturingshutdowns,withassociatedeffectsoncreditqualityand

counterpartyrisk.Furthermore,theconcentrationsintechnologyprovidersincreasesfourth-

andnth-partyrisksandrequiresamore-detailedmappingofthirdparties’suppliers.Asrisksareincreasinglydrivenbythesameunderlyingdrivers,riskmanagersmustbreakdowntraditional

risktypesilostomanagetheimpactofcommonriskdriversinanenterpriseriskmanagementfunctionorcross-functionalgroup.

1Comparingthirdquarter2025withfourthquarter2005,“WorldUncertaintyIndex:Global:GDPweightedaverage,”FederalReserveBankofSt.Louis,updatedNovember2,2025.

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement2

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement3

Shiftingcompetitiveenvironment.Thebankinglandscapeisbeingreshapedby

nonbankfinancialinstitutions(NBFIs.Indeed,theInternationalMonetaryFundnotedthatthe

shareofglobalfinancialassetsheldbyNBFIsreachedmorethan50percentinadvanced

economiesandalmost80percentintheUnitedStates.2Thisintroducescomplexityin

counterpartyriskmanagementandcallsfornewmethodstoassessandoverseelessregulatedentities.Meanwhile,themoveofmanyfinancialinstitutionsintodigitalassetsamplifiescertain

riskssuchasanti–moneylaunderingandthird-partyriskwhileintroducingnovelrisktypes

uniqueto

digitalassets

.3

Fragmentationofregulations.Afteryearsofwhatfeltlikecloserglobalregulatorycoordinationinfinancialservices,wearenowfacingamuchmorefragmentedregulatorylandscape,with

increased,althoughuneven,deregulationintheUnitedStatesunmatchedbyotherjurisdictions.Regulatorymanagementandlegalentitymanagementbecomemorecomplexinthis

environment,andsimultaneously,organizationswilllikelyincreasinglyfindareaswhereinternalriskappetite,ratherthanregulatoryrequirements,becomethebindingconstraint.

Whatwillriskmanagementofthefuturelooklike?

Thefast-changingenvironmentpresentsriskmanagementwithchallenges,butalsowitha

uniqueopportunitytorethinktheartofthepossibleforriskfunctionsandforriskmanagementoverall.Webelieveadaptabilityisanimperativeforriskoverthenextthreetofiveyears,andriskfunctionsneedtostartmakingchangesnowtoavoidfindingtheireffectivenesswaning.

Whenreinventingriskmanagement,atemptingoptionistoabandonthecurrentframeworkandrebuilditfromscratch.Butthatwouldbeamistake.Therealityisthateffectivechangeismostoftenaresultofevolution,notrevolution,encompassingbothstate-of-the-artcapabilitiesandadaptationsthatworkfortheinstitutioninquestionwhilemaintainingthefoundational

principlesofgoodriskmanagement.Belowwedrilldownintodriversofstabilityandchange:

Whatwilllargelystaythesame?

Despitealltheuncertainty,certainprinciplesandtrendswillcontinuetobeimportant.

—Thethreelinesofdefense(3LOD)haveattractedcriticismoflate,withsomemarket

participantsarguingthatabetterapproachisbasedondeeperbusinessinvolvement,

backedbytechnology.Webelievethe3LODmodel,andparticularlytheroleofthesecond

LOD,willremainfundamentalinsettingstandards,monitoringadherence,andimposing

accountability.Digitalsolutionswillplayagrowingrole,allowingthefirstlinetoefficiently

takeonmoreriskactivities,butthesuperpowersofagoodriskmanagerarecriticalthinking,intellectualcuriosity,andabilitytoasktherightwhat-ifs.InaworldofsometimesflawedAI,thosecapabilitieswillbemoreimportantthanever.

2Globalfinancialstabilityreport:Financialandclimatepoliciesforahigh-interest-rateera,InternationalMonetaryFund,October2023.

3MattHigginsonandGarrySpanz,“

Thestabledooropens:Howtokenizedcashenablesnext-genpayments

,”McKinsey,July21,2025.

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement4

—Afoundationalriskmanagementframeworkandariskappetitestatementwillcontinue

toanchorriskgovernance,riskculture,andriskmaturity.Indeed,withrisksmoreconnectedthanever,andnewriskdimensionsemerging,riskappetitewillbecomeevenmorecritical

andwillneedtoevolvesignificantly:Bankswillneedamoregranulararticulationofriskappetite,manifestedin“controlsbydesign.”

—Theexpansionfromrisktoresiliencewillremainakeyexpectationamongcustomers,

shareholders,andregulators.Itwillalsocontinuetodriveacompetitiveadvantage.In

managingmultiplerisks,banksmustembracesimplicityacrossprocesses,dataand

systems,andinfrastructure.Weexpectmorecontrolviafewercontrols.Cross-riskscenarioanalysiswillbeacriticaltooltogaugefinancialresilienceandoperationalresilienceinan

integratedway.Separately,amongriskprofessionals,thereisanever-growingimportanceofindividualresilience:theabilitytobecomfortablewithambiguityandtakeadvantageofandreactdecisivelyinchallengingcircumstances.

Whatwillchange?

InanAI-definedfuture,riskmanagementmustevolveintandemwiththechangingbusiness

processesitoversees.Itwillalsoneednewcapabilitiessuchascontinuousmonitoringandbuilt-incontrols,aswellasanenhancedsecondLOD.Thetransformationsweexpecttoseeincludethefollowing:

—Moredynamicriskappetite–settingandsimulationsreflectinggreaterrateofchange:

Tomonitortheirfinancialandoperationalresilience,organizationswillconstantlyrun

syntheticsimulationsofmacroeconomicshocks,climateevents,cyberattacks,andotherpotentialdisruptions.Beforeanymajordecisionistaken,fromacquiringaportfolioto

launchingaproductorenteringamarket,theywillassessthousandsofsimulations.

Potentially,banksmayoperatefull-scaledigitaltwinsoftheirbalancesheetsandcritical

operations,helpingthemmonitortheirfinancialandoperationalresilience.Byapplyingriskappetitemoredynamically,bankswillmakefaster,better-informedchoices,withoutlosingoutonopportunities.

—Continuousreal-timeportfoliomonitoringwithinterventionsbyexception:Inthe

languageofriskmanagement,“assurance”isdead—orrather“periodicsample-testing

assurance”isdead.Itwillbereplacedbycontinuous,oftenreal-time,monitoringas

institutionsplugintointernalandexternaldataecosystemstotracktheirexposures.Inthe

future,the3LODswillhaveaccesstothesamedatasetsandwilluse,query,andmonitor

thedatafortheirspecificpurposes.Thiswilleliminatepoint-in-timereportgenerationand

datareconciliations,enablingfasterdecision-making.Riskmanagerswillhaveaccessto

automatedportfoliomonitoring(againstthebaseline)butwillbeabletointervenetodeal

withexceptions.Thewaywemeasureandmanagemarket,liquidity,andcybersecurityrisk

today—continuouslyandataportfoliolevel,withclearlimitsandthresholds—willbeadoptedforotherrisktypes.Inparticular,today’scase-by-casecreditapprovalandperiodiccontrol

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement5

orkeyriskindicator–basedmonitoringofnonfinancialriskswilltransition.Regulatorsmayexercisetheirsupervisioninasimilarwaybyaccessingbanks’datatooverseeanindividualbankmoreeffectivelyandtoscanthefinancialsystemforsystemicrisksandrequired

interventions.

—Integratedriskprofilingacrossrisktypestoassesstheultimatecausesforrisk

holistically:Managementoffinancial,nonfinancial,andstrategicriskswillconverge.Risk

leaderswillusedatatoidentifytherootcausesofrisk,bothhuman(customers,employees,andthirdparties)andinfrastructural(processes,systems,anddataormodels).

Understandingcustomerrisk,forexample,willconsidereverythingfromcredithistorytofinancialcrime,fraud,andcyberrisk.Siloeswillbeconsignedtohistory.Instead,risk

functionswillembraceagile,squad-basedoperatingmodels,supportedbyriskdomainexpertsandanalytics-savvyspecialists.

—Ahybridworkforceofmultiagentsystemsand‘humansintheloop’:Riskfunctionswill

betech-drivenbuthuman-supervised.Theday-to-dayoperationalworkofriskofficers

(suchasmonitoringexposures,scoringcredit,anddetectingfraud)willbefullyautomated.Theriskfunctionwillbecomeahybrid,withbotsandagentsbackedbyasmallgroupof

experts,acohortofAItrainersandassurers,and“ethicsstewards”toensuretransparency,fairness,andunderstandingofautonomousAIdecisions.

—Humanriskmanagersequallyvaluedforsubject-matterexpertiseandcritical

orthogonalthinking.Theroleofthehumanintheloopwillshiftfromcontroltooversight.

Thiswillrequiretherighttalenttonotjust“checkboxes”butthinkoutsidetheboxand

ensurethatautomationdoesnotcreatetailrisks.Thecompositionoftheriskfunctionwill

employsubjectmatterexperts(forrisktypesandanalytics)andintegrativethinkers.Risk

managerrolesthataremoreprocess-focusedwillbenonhuman.Totrainthehuman

workforce,wewillseemoreadaptable,scenario-andsimulation-basedlearning(ratherthanlearningbydoing)whichwillenableemployeestobecredibleandeffectivehumansinthe

loop.

Rethinkingtheriskfunction

Historically,riskfunctionshaveprimarilybeenorganizedbyrisktypes,businessareas,ora

combinationofthetwo.Inthefuture,webelieveriskfunctionswillneedtobeorganizedaroundthreeseparateelementsthateachplayacriticalrole.Eachelementwillhavedistinctdefined

objectivesandtalentprofile(exhibit):

1.Strategicnervecenter.Thiswillbethecross-cuttingintelligenceunitoftheriskfunction,

inwhichriskappetiteandlimitsareset,emergingrisksareidentified,scenariosarerun,

andinsightsareprovidedtotherestoftheinstitution.Thefunctionwillconnectthedots

betweenrisktypesanddrawonanalyticsfromadedicatedcenterofexcellence(discussedbelow).Theworkforcewillbemadeupofhigh-caliber,cross-functional,strategicthinkers.

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement6

2.Domain-specificpods.Podswillbeorganizedaroundrisktypesorothercriticallydefineddomainssuchasmateriallegalentities.Theywillbemadeupbysenior,criticallyadeptriskmanagerswhowilloverseethebank’sportfolioofrisksandapplyjudgmentonexceptionalcases.Thepodswillbelargelybusiness-facing,whilethebulkofoperationalrisk

managementandoversightwillbeundertakenbybotsandagents.Theunitswillbestaffedbydeepsubject-matterexperts,suchasthosefocusedonspecificriskdisciplinesor

entities.

3.Analyticssharedcenterofexcellence(COE).TheCOEshouldbetheriskfunction’sengineroom.Itwillanalyzevastamountsofdataasitconstantlymonitorsforoutliersand

thresholdbreaches.Activitiessuchasreportingwillbefullydigitizedandavailableviaself-servefunctionality.Thefunctionwillconsistofhybridsquadsofmultiagentsystemswith

humansintheloop.

Exhibit1

Thefutureofrisk:Howglobaltrendsarereshapingriskmanagement7

Theorganizationofriskintothesethreeelementsallowsfordevelopingparalleltalentvaluepropositions,performancemanagement,andcareerpathsforthetalentwithineachelement.

Talentinthestrategicnervecenterwillbewelltrainedtotakeonbroaderrolesincluding

executiveleadershipriskrolesoutsidetheriskfunction.Talentinthedomain-specificpodscandevelopandberewardedfordeepsubject-matterexpertisewhiletheanalytics-basedCOE

allowsfordeepdataandanalyticalexpertise.Wewouldexpectthemajorityoftalentinthefutureriskfunctionwilldedicatethemselvestooneofthethreeelements,whilerotationalprogramsshouldexistbetweenthemtoensuresufficientcross-pollinationofideasand

understandingoftheinterconnectednessoftheelements.

WhatshouldCROsdonow?

Thecurrentrateofchange,bothintheexternalriskenvironmentandinternalriskcapabilities,amounttonothinglessthanaparadigmshift.So,howshouldchiefriskofficers(CROs)begintobuildariskfunctionthatcanaccommodatethemorefluidandunpredictableenvironment?Weseefourimmediatesteps:

—Investinupskillingyourselfandyourteam.Theriskfunctioncanbethebiggestinhibitor

orenablerofchange—dependingontheCRO’smindsetandindividualcapabilities.For

example,wehaveseenproactive,progressiveriskleadersactascriticalenablersfor

acceleratedAIadoption,andthosethatdonot.Riskleadersneedtounderstandthe

opportunitiesandinvestineducatingthemselvesandtheirteamsonAI,itsapplications,anditschallenges.

—Strengthencross-cuttingcapabilities.Whileriskfunctionsmaynotyetbereadyforthe

fullstrategicnervecenter,itiscriticaltostartaddressingtheneedforcross-riskanalysisandmanagement.Thiscanhappenthroughstrengtheningtheenterpriseriskmanagement

orbusinessriskfunctionsoftheorganizationorbyinvestinginrisk-agnosticmonitoringandresponsecapabilitiestostayaheadoftheshiftingrisklandscape.

—EnsureresponsibleandtransparentAIuse.CROsshouldspearheadthedesignand

deploymentofriskmanagementmechanismsforAI.ThesewillincludecleargovernanceframeworksforAIuse-caseapprovalandmonitoringandAIprocessesthatappropriatelytriagebasedonAIriskcharacteristicstoensurethattheorganizationcansolveforbothsafetyandspeed.Transparentdocumentationandethicalguidelineswillsafeguardfirmsagainstregulatorybr