In July 2024, the Risk Management Association (RMA) surveyed 177 chief risk officers (CROs) and risk leaders primarily from North America-based banks on their top challenges. They described an industry transformed by the 2023 regional bank crisis: regulators and exams have been more demanding, with a belief that this will continue to be the case in the immediate term, risk teams have a larger strategy role, and there is greater appreciation for the speed of risk. Meanwhile, non-financial risks including data breaches and fraud remain urgent. And while financial risks have fallen from the very top of CRO concerns, they are formidable.
CROs and their teams — whose agendas were already full before the crisis — are now facing added challenges stemming from it. The future holds even more uncertainty, as risks and opportunities emerge from the rise of generative artificial intelligence (AI) and other technology, geopolitical events, market behavior, and as-yet-unknown sources.
This latest edition of the RMA, ProSight, and Oliver Wyman CRO Outlook Survey reveals that banks are in a new environment compared with the years prior to the crisis. The speed of risk is faster, regulators are more demanding, and, as a result, the risk function’s role in strategy is larger. Informed by an analysis of the survey results as well as post-survey interviews with respondents, our report explores seven key themes that illuminate how banks are responding to a changed industry, even as they address additional challenges.
1. Banks are more alert to the speed of risk
93% of respondents noted a need for the banking industry to adapt to the increased speed of risk demonstrated by bank stock volatility, unprecedented deposit runs, and other developments last year. CROs mentioned that their institutions are implementing new early warning indicators and risk limits, enhanced scenario analysis, crisis management and incident response plans, and revised models that leverage data from the 2023 crisis.
2. Regulatory scrutiny in banking has heightened supervisory expectations
Respondents report that, in the aftermath of the crisis, regulators are seeking more rapid responses to regulatory questions and findings. Over the next 12 months, respondents expect enhanced scrutiny regarding credit risk, liquidity, and capital.
3. Risk management’s expanding role in banking strategy
Many risk teams have become more involved in bank strategy. They are defining and managing the appetite for strategic risk, participating in non-risk committees, and challenging strategic plans.
4. Financial risks in banking remain high despite lower ranking
While financial risks ranked lower than in previous surveys, CROs warn that trouble continues to brew in commercial real estate and consumer credit, and that lower interest rates may not allay deposit-funding pressures. At the same time, evidence is mounting that years of inflation and the spending down of stimulus cash is taking a toll on many consumers’ ability to make credit card and loan payments.
5. Non-financial risks in banking remain elevated
The top three risks the survey identified were non-financial: cybersecurity, fraud/financial crime, and technology. CROs say fraud and cyber threats are driving risk-function budgets higher, and that regulators are joining them in a focus on non-financial risks. They expect third-party risk, cybersecurity, and governance and controls related to AI to draw increasing regulatory pressure.
6. Emerging risks and disruption in financial services demand strategic planning
Digital disruption, including generative AI’s impact, ranked as the top emerging risk. CROs are addressing this and other emerging risks by launching new reporting — including KRIs and KPIs — and incorporating new formalized approaches and board-level oversight.
7. Bank CROs must invest now to boost future resilience
With challenges related to the regional bank crisis layered atop perennial risks, bank risk management is not getting easier. Risk leaders are responding with projects to help institutions mitigate risks and optimize opportunities. The most common initiatives center on analytics and modeling, cyber/technology risks, risk data and infrastructure, AI, and risk governance and reporting.
This report was written in collaboration with the Risk Management Association (RMA) and ProSight Financial Association.
