New ways of working in Risk

In today’s dynamic business landscape, organizations are experiencing an unprecedented acceleration in their pace of transformation, and this impacts the ways risk is delivered, sourced, and located. The rapid evolution and dissemination of technology, changing consumer expectations, competitive pressures, and the ever-present demand for innovation have compelled companies to reassess their strategies and embrace change more readily than ever before.

Companies are now required to adapt to new technologies (e.g., generative artificial intelligence [GenAI], core function and process automation, and advanced tooling) to stay relevant and competitive. Also, as consumer preferences, needs, and expectations continue to shift, companies must adapt to these changes and transform their products, services, and operations accordingly. With all those factors in play, companies are evolving faster than ever to remain viable and relevant—and risk organizations must transform how they are delivering risk to meet the changes across value streams and the business.

Dive into our thinking

Explore how organizations are changing how risk is delivered as they accelerate enterprise-wide transformation.

Download PDF

As organizations confront the urgency to transform in today’s fast-paced and competitive environment, it is important to examine the key impacted areas: strategy, technology, people, and service delivery. This section highlights how businesses are embracing agile and resilient organizational models to navigate the complex business world, adopting cutting-edge technologies to enhance risk management capabilities, upskilling their teams for emerging challenges, and evaluating their service delivery models to maximize operational efficiency.

Strategy

Increasing agility and resilience

Technology

Integrating AI and unifying the technology vision

People

Capability uplift and capacity optimization

Service delivery

Establishing centralized functions, nearshore, or low-cost facilities

Increasing agility and resilience

Organizations are adopting more strategic and agile models in response to the rapidly evolving business environment characterized by growing complexity, increased competition, and emerging technologies. By integrating risk management into the overall strategy, prioritizing responsiveness and adaptability, and fostering cross-functional collaboration, organizations can build stronger resilience, ensure regulatory compliance, maintain competitiveness, and enable sustainable growth. In fact, in the 2023 KPMG Chief Risk Officer Survey, 47 percent of respondents indicated that providing employees with training and resources on risk management and corporate strategy alignment is critical to effectively align or continue to align risk objectives to the business’ strategic goals and priorities.

Risk managers are embracing strategic and agile models to:

Develop adaptable risk management frameworks that easily adjust in response to changing business conditions or emerging/evolving risks.
Reevaluate key performance indicators (KPIs) and reporting mechanisms to ensure the effectiveness of risk management initiatives.
Foster avenues of clear communication and collaboration between departments by sharing information, perspectives, and best practices through centralized functions and working groups.
Rationalize risk accountabilities across legal entity, functional, and organizational roles.
Harness hybrid and remote work arrangements to further bolster the resiliency of risk management functions.
Utilize integrated systems (i.e., single platform, linked systems, and data repositories) to enhance the user experience, provide elevated risk awareness, and meet ongoing risk demands with greater efficiency and speed.
Monitor data in real time to provide faster insights into risks and enhance risk decisioning.

Integrating AI and unifying the technology vision

Organizations are increasingly implementing tools (e.g., generative AI, machine learning [ML], data analytics, automated control testing, and real-time reporting) to enhance their risk management capabilities. By implementing these tools, organizations can better identify and mitigate risks, improve decision-making, as well as achieve greater efficiency, reduce manual tasks, and understand risks in real time. And when it comes to increasing efficiencies, respondents in the 2023 KPMG Chief Risk Officer Survey indicated that AI and ML would play critical roles in accelerating risk management processes within their organizations in both the current (63 percent) and future (69 percent) state. Emphasis should also be placed on getting decision-making risk data into the hands of decision makers in real-time through incorporating risk information in business productivity reports, as well as tools and dashboards.

Risk managers are leveraging technology to:

Automate manual and repetitive processes, such as risk assessments, compliance checks, data collection, and surveillance.
Identify patterns, trends, and potential risks that would be difficult or impossible for human risk managers to detect.

Capability uplift and capacity optimization

Organizations are having to rethink their approach to the labor market as employees have more options and are seeking flexibility in their jobs. There continues to be intense competition to attract and retain talent. By investing in their people, organizations can better ensure they have the right people with the right skills to meet the demands of the new risk management function. In the 2023 KPMG Chief Risk Officer Survey, 48 percent of respondents stated that increasing training for employees in targeted areas would empower them to prepare for and address risk challenges.

Risk managers are building a future-first workforce with the following approaches:

Rationalize the current risk organization resourcing allocated to risk functions, including workload, skills, and task distribution, to ensure the staffing meets the future demands for business process, technology, and risk programs.
Supplement teams with new job types (e.g., technologists, data scientists) to meet the increased focus on new and emerging technologies.
Leverage hybrid working arrangements, such as remote work, to expand the talent pool. This allows for access to resources across a larger population, enabling the organization to find best fit talent for the risk function needs.
Perform ongoing capacity evaluations and forecasting.
Revise risk workforce management and retention strategy to enhance employee growth and provide career-development programs that foster professional development and guarantee a well-equipped workforce.

Establishing centralized functions, nearshore, or low-cost facilities

Companies are increasingly turning to different service delivery models (e.g., offshoring, outsourcing, and centralized internal functions) as strategic business decisions to reduce costs, enhance operational efficiency, and access a diverse global talent pool. By delegating non-core functions to specialized service providers and leveraging resources in other countries, businesses can focus on their core competencies, therefore fostering innovation and maintaining a competitive edge. Each service delivery model provides several benefits for risk managers:

Nearshoring or offshoring
Offshoring standardized, repeatable activities to lower-cost solutions (e.g., countries with lower labor and operational costs) will reduce overall expenses significantly while still receiving quality services. Also, companies can tap into the global talent pool and work with experts with extensive knowledge and experience in risk management. This enables them to allocate resources more effectively towards core business operations and growth initiatives while enhancing risk mitigation strategies and improving their overall capabilities.

Outsourcing
Outsourcing risk as a service can be achieved by using third parties to execute select risk management activities on behalf of first, second and third line risk functions. Doing so affords a cost-effective option for sourcing risk talent for key organizational needs, while also permitting CROs to deploy in-house talent on more mission-critical needs. Also, this puts greater focus amongst in-house resources on strategy and growth activities. In the 2023 KPMG Chief Risk Officer Survey, 33 percent responded they would exclusively consider outsourcing 1) strategic risk management and planning, 2) financial risk analysis, and 3) cybersecurity and threat protection services to enhance the efficiency and effectiveness of risk mitigation strategies.

Centralized internal service functions
Establish centralized internal service functions, center of excellence (e.g., testing), and shared utility functions (e.g., reporting) to deliver risk functions to the enterprise. This ensures standardized risk management processes, methodologies, and tools across the organization and provides specialized in-house experts and resources. Additionally, it offers a deep understanding of best practices and industry trends and establishes better visibility and understanding of potential risks across the organization by facilitating communication and coordination between different business units and teams. Finally, it serves as a hub for sharing best practices, technical know-how, and lessons learned from previous risk management initiatives.

Organizations should consider their own unique situations and maturity when undertaking transformation efforts. This type of change requires a thoughtful and strategic approach and should be done with great care to maximize the new and emerging ways of working. Before launching any specific initiatives, organizations should evaluate your current risk function to identify specific areas within the four mechanisms that are “ripe” for optimization, including:

Strategy. Adopt flexible risk management frameworks, reassess KPIs, promote transparent communication and teamwork, and streamline risk responsibilities to strengthen the handling of evolving risks in a dynamic business landscape.
Tech. Improve efficiency by automating repetitive tasks, detecting emerging trends and threats, using interconnected systems, and monitoring data in real time to enable quicker insights and decision-making for proactive risk management.
People. Examine ways to rationalize risk function resources, integrate various job roles, utilize hybrid work setups, conduct regular capacity assessments, and update workforce management tactics to create a proficient, adaptive, and skilled workforce prepared for future challenges and managing emerging risks.
Service delivery. Pursue a three-tiered strategy to offshore/multi-shore talent while simultaneously pursuing automation and outsourcing of more operational tasks to optimize the cost/value ratio of risk spend. This will drive efficient resource distribution, enhanced risk reduction strategies, and collaborative exchange of best practices across the organization.