Skip to main content
Submit RFP

      As regulatory expectations, data complexity, and emerging technologies evolve, risk management in banking is undergoing a fundamental transformation. This article is a deep dive into Predictive Risk Management, part of the “Future of Risk in Banking” Whitepaper, covering more on how traditional risk management techniques are forced to (and already are) changing. We explore what defines the effective risk manager of tomorrow, and the critical achievements to future-proof their risk functions.

      Modernising the risk cycle: A strategic shift in progress

      Banks are modernising risk management in response to growing geopolitical, economic, and regulatory pressures. While the shift towards predictive, technology-enabled approaches is underway, some institutions are still in the foundational phase.

      This change aims to accelerate identification of relevant risk events, assess their impacts efficiently, and enable prompt and effective responses. Additionally, it is essential to reduce costs on a per-task basis and ensure process scalability to drive cost optimisation.

      Central to this evolution is the transformation of each aspect of the risk management cycle — Identification, Measurement, Monitoring, Control and Reporting. Banks are working to enhance each stage using automation, analytics, and digital tools, aiming to move from static to dynamic, forward-looking capabilities.

      Reliable data from integrated systems are one core prerequisite, which is why data management and infrastructure must evolve. Without high-quality inputs, advanced tools and data-driven modelling, it isn’t possible to deliver meaningful insights. Another relevant aspect for the risk management of the future, is the agile mindset of the risk managers: being able to change perspective, react quickly, and anticipate changes in the markets operated in a forward looking way with the aim to identify threats – and maybe even opportunities - to the plan as early as possible.

      While the CRO function should continue to be focused on regulatory compliance, they are leading efforts to reposition risk as a strategic function. Yet progress remains uneven due to legacy systems, siloed data, and organisational inertia, and effort should be increased to unlocking the strategic potential and value generation.

      The effective risk manager of tomorrow

      Tomorrow's risk manager — particularly the Chief Risk Officer (CRO) — will likely operate at the intersection of advanced analytics, automation, and strategic business leadership. The profile is evolving from regulatory steward to value-adding decision enabler.

      Decision-making and modeling: AI and technology as a core enabler (and associated risk management)

      Artificial intelligence (AI) in particular Agentic AI is becoming a core part of the risk manager’s toolkit, supporting faster, more accurate, and adaptive decision-making across risk management. Examples include:

      • Model development

        AI techniques leverage far larger and more diverse datasets than old legacy models. In addition to internal data, models use additionally external sources (including joint data platforms with other market participants), direct data from their clients (e.g. cash projects and cash flows) enabling highly precise, client- and case-specific (behavioural) modeling that ensure a real time view on the underlying risks.

      • Model validation

        AI autonomously handles the full validation process (at least for models applied for standard cases), with human experts conducting sanity checks only afterwards and/or focusing on very bespoke models to help ensure robustness and reasonableness. The workforce will become more and more supervisors of the AI model validators. This approach significantly increases the efficiency of performing validation tasks while maintaining necessary oversight. It also changes the job profile in validation from performing repetitive tasks and documentation to challenging the AI‘s results.

      • Risk control

        AI-based systems now move beyond static rule sets, using concepts such as anomaly detection, behavioral pattern recognition, and natural language processing (NLP) to flag emerging risks. Examples include detecting abnormal transactions via unsupervised learning or analysing media sentiment to identify reputational threats or deploying Agentic AI that autonomously monitors multiple data streams and proactively initiates risk mitigation actions. Reinforcement learning is also being used to adjust thresholds dynamically.

      • Risk analysis

        Analysis and explainability of results will likely be highly supported by strong capabilities, including AI. First drafts of result changes and sensibility of results can be provided to risk managers directly. Their role will be to review the proposals, adjust and dig into details to provide their management with high quality analysis and profound material for decision making.

      Despite these advances, AI introduces its own risks — such as inaccuracy, biased decisions, (in particular) lack of reliability, or noncompliance — especially when based on flawed data or opaque algorithms. CROs not only deploy AI but also use their judgment and expertise to interpret and govern its outputs. Hence, building up an AI and IT risk management approach along the risk-management cycle is an important foundational priority for CROs. While various elements of managing these risks are like well-known risks of the past – further aspects (such as AI fairness, reproducibility of results, stronger linkage to players in the bank’s external ecosystem (e.g. IT partners, joint data usage across various partners)) will pose new and complex challenges.

      End-to-end process management and automation

      Efficiency is no longer optional in today’s competitive and regulated landscape. Risk functions are increasingly embracing end-to-end (E2E) process automation, enabling faster throughput and consistent quality.

      • Process mining

        Process mining offers a powerful tool to enhance operational efficiency by visualizing and analyzing real process flows based on system data. By uncovering inefficiencies, deviations, and bottlenecks, organizations can simplify and optimize processes, leading to greater transparency and control. This not only boosts productivity but also systematically reduces operational risks by eliminating complexity, inconsistencies, and manual interventions.

      • Risk analysis automation

        In addition to the design of the process itself, using process mining and AI, banks are also automating the identification of risk-relevant process deviations (e.g., in transaction monitoring workflows), allowing earlier interventions and reducing incorrect decisions.

      • Automated reporting

        Reporting is becoming much more standardized and automated, with intelligent platforms not only generating reports but also interpreting data in real time. These systems provide contextual and meaningful insights, enabling better-informed and faster decision-making by stakeholders.

      Value creation: The expanded role of the CRO

      As risk becomes a central lever in strategic decision making, the CRO’s role is expanding beyond governance to active participation in value creation – supporting business while maintaining their 2nd line of defense role:

      • Data-driven strategy

        CROs increasingly use risk data to identify growth opportunities, such as underserved segments or products with favorable risk-return profiles. This analysis supports business but also is an added value in risk-return discussions with their business counterparts.

      • Integrated business decisioning

        By embedding risk insights into pricing, capital allocation, and investment planning, the CRO helps balance profitability and resilience.

      • Sustainability and non-financial risks

        The CRO agenda now places growing emphasis on non-financial risk areas such as emerging and geopolitical risks, ESG, IT, cyber, and reputational risk. These are managed using advanced analytics to quantify exposures, detect vulnerabilities, and enable proactive mitigation. Increasingly, this also includes oversight of AI and technology-related risks (and are managed accordingly as explained above).

      The CRO of tomorrow must be both a guardian of stability and an architect of sustainable growth.

      Employer attractiveness: A more strategic and impactful profile

      The evolution of the risk function also makes it more attractive for top talent. The new risk profile is defined less by manual routines and regulatory box-ticking, and more by strategic involvement, technology use, and real-world impact.

      • More meaningful work

        With automation reducing repetitive tasks, risk professionals are increasingly tasked with interpreting the interplay of diverse data sources, supporting business strategy, and managing emerging risks—making the work intellectually engaging and purpose-driven.

      • Tech and data-oriented roles

        The integration of AI, data science, and process automation introduces new career paths within risk—blending quantitative skills with business understanding.

      • Stronger visibility and influence

        Risk functions now play a central role in strategic decision-making. The CRO’s insights are no longer seen as reactive or impeding but are valued as essential inputs that balance opportunity with resilience—shifting the function’s image from a compliance enforcer to a trusted business partner.

      This shift supports talent acquisition and retention by offering a compelling, future-oriented career path—particularly for technologically proficient professionals who seek influence and purpose in their work.

      The road ahead: What must be achieved

      Data infrastructure and governance

      High-quality, integrated, and real-time data is the backbone of predictive risk management. Banks should invest in data, consistent taxonomies, and strong data ownership models to support AI and automation.

      Talent and mindset shift

      Tomorrow’s risk professionals need interdisciplinary skills — combining regulatory knowledge, quantitative methods, and digital literacy. Enhancing skills and fostering collaboration across different functions will be crucial.

      Technology enablement

      Legacy systems should be modernised. Scalable cloud platforms, interoperable APIs, and secure AI services are prerequisites for the risk function of tomorrow. Banks should adopt modular and future-proof architectures to avoid legacy system burdens.

      Cultural and organisational alignment

      Risk awareness should be embedded across the organisation. This means shifting from a control-first mindset to a value-partnership mindset — where risk teams are co-creators of strategic business decisions and are seen as such throughout the organisation.

      Conclusion

      The future of risk management is not a distant vision — it is already taking shape. Forward-looking, predictive CROs and risk leaders who embrace technological advancement, process integration, and data-enabled decisioning can transform risk from a compliance necessity into a strategic advantage. The journey requires bold investment and a reimagined mindset — but the payoff is a resilient, agile, and insight-driven risk function ready for the challenges of tomorrow.

      Related content

      Transforming risk management for a dynamic new era
      Read more

      Building a trusted risk function to succeed in a riskier world
      Read more

      Our people

      Jonathan Ho
      Jonathan Ho

      Partner, Head of Risk, Advisory and Head of Infrastructure, Government & Healthcare

      KPMG in Singapore

      Connect with us

      KPMG combines our multi-disciplinary approach with deep, practical industry knowledge to help clients meet challenges and respond to opportunities. Connect with our team to start the conversation.

      Contact us