Risk & Resilience Practice

Risk and resilience

priorities, as told by
chief risk officers
Amid the storm of crises and disruptions, leading financial institutions
are recognizing risk’s strategic and resilience-building role.
This article is a collaborative effort by Marc Chiapolino, Filippo Mazzetto, Thomas Poppensieker,
Cécile Prinsen, and Dan Williams, representing views from McKinsey’s Risk & Resilience Practice.

© Ulrike Schmitt-Hartmann/Getty Images

December 2022
 At this moment, economies and societies are employees and in the area of nonfinancial risk. Few,
enduring several crises simultaneously. All have however, expected those effects to retain their force
major humanitarian impact and potentially long- in three years’ time.
lasting second- and third-order effects. The era is
Climate change, on the other hand, is expected to
defined by the interplay of complex disruptions with
grow in importance. Almost all respondents (92
disparate origins and long-term consequences.
percent) assessed climate regulation as one of the
Climate change, the COVID-19 pandemic,
five most important forces in the financial industry
record inflation and monetary tightening, supply
in the coming three years. Three in four (75 percent)
disruptions, and increased geopolitical risk—all
stressed the significance of climate-transition
pose urgent questions of organizational resilience
risk—those financial and other risks arising from the
that cannot be addressed in isolation.
transformation of global energy systems away from
In a business environment subject to constant carbon-based fuels.
disruption, superior risk management has become
Cybercrime was consistently assessed as one of
a competitive advantage in all industries. Financial
the top five risks by most executives (58 percent
institutions are no exception. They are seeking
and increasing), now and in the coming three years.
to become more resilient. With scenario-based
Other high-ranking risks included evolution of work
foresight, monitoring of early indicators, and
practices and AI—its use and misuse. Forty-two
crisis-response capabilities, they can become
percent of CROs ranked these risks in their top five
capable of absorbing the shocks, pivoting, and
risks in the coming three years.
accelerating into new realities. In this first of a series
of articles on risk management in banks, we explore Looking at the evolution of financial services, CROs
perspectives of chief risk officers (CROs) from some identified accelerated digitization and entry of
of the world’s leading banks on the evolving context nontraditional competitors, fintechs especially, as
and priorities. the top trends they are following. All respondents
agreed that digital transformation is the most
consequential initiative today; this will be true also
What CROs are thinking
in the coming three years, as these transformations
To discover the latest thinking of banks on risk and bear significant operational and execution risks.
resilience, McKinsey conducted survey-based
The entry of nontraditional competitors will
research in late 2021, engaging with more than 30
significantly affect the financial sector, according
CROs. We asked about the current and evolving
to 75 percent of respondents; 67 percent see
banking environment, risk management practices,
integration of fintech-vendor services into banks as
and forthcoming priorities. We quickly discovered
a major trend in the coming years.
that the great majority of CROs were already
taking a long-term view when planning actions and Interestingly, at the end of 2021, only one CRO
identifying future themes. This perspective was only identified the geopolitical environment as a risk of
strengthened by the 2022 disruptions such as high serious consequence for banks—a result not unlike
inflation and geopolitical turmoil. Here is what the the view most executives held in 2019 toward the
CROs said. danger of a global pandemic occurring in 2019. It is
likely, therefore, that the industry is exposed now to
The banking environment
unanticipated risks that could strike in the future.
Regarding the economy and business environment,
Building a resilient model means increasing banks’
respondents pointed out that banks were especially
ability to respond effectively to unforeseen events.
exposed to accelerating market dynamics, climate
change, and cybercrime. More on the major risks banks face
We noted that the top three risks which most
Most responding CROs (67 percent) cited pandemic
concerned the CROs in our survey were direct
effects as having had significant impact on

2 Risk and resilience priorities, as told by chief risk officers

financial impact, harm to customers, and data issues ranked ahead of inaccurate models,
reputational damage (such as from conduct model misuse, or privacy and security concerns.
events). Each of these risks were ranked first by
Regarding time expenditure of CROs and board
approximately 30 percent of responding CROs.
risk committees, the regulatory agenda ranked as
They ranked the potential harm caused by these
the top time-consuming agenda item (40 percent)
risks as greater than that from other risks such as
followed by emerging risks (15 percent), strategy
legal or regulatory events.
for business growth or innovation (14 percent), and
A great majority of CROs stated that cyber, data, specific risk decisions (13 percent).
and technology risks (including related IT and third-
Most respondents (60 percent) expected the
party risk) and climate risk will mostly underlie the
institutional share of staff dedicated to the
adverse impact. Eighty percent of CROs, that is,
regulatory agenda to grow in the coming three
identified these risks as rising in importance year
years, with additional regulatory resources needed
after year and considered them among the top
most of all for climate risk, a number of nonfinancial
five risks. Credit risk also remained as one of the
risks (cyber, conduct), and credit risk.
top risks for 70 percent of CROs, but was seen as
decreasing in impact over time. Interestingly, other
types of financial risks—for example, interest-rate How can risk functions lead
risk, liquidity risk, and market or price risk—were the resilience effort?
rarely included among the top five risks.
Leading organizations, public and private, including
On the topic of data, poor data quality was of financial institutions, are attempting to move
greatest concern for 58 percent of respondents. to a resilient stance in relation to the disrupted
The majority, that is, ranked this risk well above environment. The drive for resilience is a turn away
other data-related risks, such as unauthorized data from the narrow crisis-response reflex and toward
access (28 percent) and lack of data availability. an agile state, where large, complex organizations
Half of respondents were also concerned that data protect against proximate risks, absorb shocks,
issues will most hinder usage of advanced-analytics and then pivot into the new realities. Decisions
models. Regarding risks related to models, potential made during crises have lasting effects, beyond the

Resilience is a leadership orientation—

toward making choices in the crisis
that set up organizations for growth in
recovery periods.

Risk and resilience priorities, as told by chief risk officers 3

 downturn. Resilience is a leadership orientation— Where is risk management going?
toward making choices in the crisis that set up
CROs are seeing five main areas that are
organizations for growth in recovery periods. Risk
structurally evolving to shape risk management in
must now become a function contributing to, if not
the future.
leading, the resilience efforts of banks.
1. Evolution of the three-lines-of-defense model
CROs acknowledge that they need to spend more
Expectations on the role of the risk function are
time considering “over the horizon risks.” This
changing, and greater collaboration is expected
gap in thinking was brought into sharp focus by
across the lines of defense. The first line of defense,
the heavy impact the COVID-19 pandemic and
the owners of particular processes and operations,
geopolitical tensions had on their institutions’
are seen by CROs as becoming more proficient
risk profiles—including second- and third-order
in risk management and therefore handling more
effects—such as supply chain risk, inflation, and
risk-taking decisions, such as those entailed in
rising interest rates—which were not anticipated
underwriting, collections, fraud management, and,
by most banking executives.
in some cases, designing regulatory models.
Institutions were little prepared to address these
As a consequence, the three-lines-of-defense
highly consequential risks. The failure goes well
framework is evolving to refocus the risk function
beyond risk functions, however. Many organizations
on typical second-line responsibilities, including
used forecasting to develop market strategies,
appetite setting and monitoring, policy setting,
but this approach failed to pick up major reality
the challenge role, and second-line controls and
shifts in the recent past—from the financial crisis
reporting. To be effective in its second-line role, the
of the 2000s to the pandemic to geopolitical
function should be stepping up its competence in
realignments. Leading institutions are moving to
new risk types arising in the domains of cyber and
scenario-based foresight to increase institutional
tech security as well as climate change.
resilience against over-the-horizon risks. The risk
function can play an important role here in ensuring Almost all respondents to our survey said that
that the scenarios capture existing and expected for financial risks, the delineation of roles and
risks, while aligning function priorities against responsibilities between the first and second
scenarios. lines is clearly defined and well understood in
their organization. The divisions are less clear for
In this area, risk leaders can focus on two important
nonfinancial risks, however.
themes:
2. Digitization: New technology, tools, data,
1. Risk functions need to develop more
and an ‘old’ issue
sophisticated risk-identification processes.
The risk function can rely on new technologies,
New risks emerge quickly in this dynamic
tools, and more data, even if some of these building
environment, so they need to be discovered fast,
blocks retain “old” issues. For example, new internal
along with their potential impact areas.
and external data and new technology, including
2. Investment is needed in foresight tools, such AI, can improve the quality of risk monitoring and
as “nowcasting,” which can feed nearly live decision making, with early warning systems and
quantitative data to help define scenarios and real-time controls. Here, the digital transformation,
understand their impact on the main metrics highly valued by all responding CROs, is expected to
of the bank. The risk and resilience function, improve the basic efficiency of the function.
modeling the strategic institutional stance, can
Many CROs believe, however, that they will continue
develop planning cadences in which scenarios
to be affected by the old issue of poor data quality.
and action plans are continually refreshed.
As previously mentioned, more than half of

4 Risk and resilience priorities, as told by chief risk officers

respondents (58 percent) believe that advanced- and environmental, social, and governance (ESG)
analytics applications will be negatively affected regulation, which is set to evolve and tighten in the
by data issues, especially poor data quality. The next three years. CROs believe that climate and
vulnerabilities can be addressed by exploring and ESG will soon be among the main regulatory themes
developing new types of algorithms to improve the affecting the financial-services industry.
quality of risk decisions. The effort can be supported
Banks have been prone to poor regulatory
by an analytics center set up within the bank.
remediation processes. In response, risk functions
Reporting and monitoring, a core responsibility of at leading institutions are seeking to build
the risk function, remains excruciatingly difficult, best-in-class processes, specialized skills, and
prone to manual intervention, and burdensome in organizational models needed to lead regulatory
most institutions, despite almost ten years of costly projects. In particular, attention is being given to
interventions after BCBS 239.1 Improvements are agile ways of working. Overall, early and proactive
therefore sorely needed. Digital budgets have engagement with regulators is the most important
already grown significantly in recent years, however. means to achieve alignment of regulatory demands
Only 25 percent of CROs foresee an increase in the with compliance and control strategies.
share of budget dedicated to digitizing activities.
4. Market shifts and new risk priorities
This means that needed improvements in reporting
Banks are coming under increased cost pressures
and monitoring will have to be achieved largely
as risk levels could rise in the short term. Low-cost
through improving risk-function efficiency.
market entrants, such as fintechs, are challenging
Most CROs see existing digitization resources as business models. CROs are about evenly split in
the means to gain efficiency in traditional risk areas their expectations on the size of future risk budgets.
as well, especially credit risk, which will attract the Most of those who see a reduction in real spending
bulk of investments, as credit decision making is are from banks that are leading in the digital
digitized and the controls are automated. transformation of the function. These institutions
are driving cost reduction programs at the group
3. Regulatory expectations
level. Most CROs expect risk budgets will reflect
Prudential regulation is already having a significant
shifting priorities and maturity in managing the
impact on banks’ market positioning and risk agenda.
different risks. For example, risk professionals have
These effects are expected to retain their strength (or
observed a 5 percent decrease in credit risk over
grow in importance) in the next three years.
the past two years; conversely, they expect certain
New regulatory areas, including refinements to risks to rise in importance, including model risk,
existing regulation, continue to emerge. AMLA, climate risk, and technology-related risks. Such
the European Union’s new anti–money laundering changes tend to affect the risk skill mix rather than
authority, for example, will become operational the size of the function.
in 2023. It is expected to pursue regulatory
5. Creating and demonstrating value as
harmonization across borders, which will affect
a risk function
banks’ coordination and supervisory responsibilities.
Historically, the risk and compliance functions
This move is in line with the general regulatory push
in banks have focused on defining frameworks
for consistency in policies, tools, and risk decisions
and establishing standard risk processes
in complex institutions, along with the ability of those
and governance—such as those around risk
institutions to perform global oversight.
identification and assessment, monitoring
While retaining focus on existing regulation, CROs and reporting, and remediation. Now, leading
are closely watching the development of climate organizations are starting to focus on the value that

1
A standard for risk data aggregation and risk reporting developed by the Basel Committee on Banking Supervision in 2013.

Risk and resilience priorities, as told by chief risk officers 5

 those functions can and should create. This helpful partnering with fintechs. Those efforts are ongoing
Find more content like this on the shift moves attention and resources from more even as risk managers address more immediate
McKinsey Insights App
bureaucratic, documentation-oriented exercises to macroeconomic and political disruptions.
execution and business outcomes. When properly
Clearly, in this period of economic crisis and change,
carried through, the focus on value becomes
risk capabilities are needed more than ever. The
a powerful lever for business simplification,
needs grow in the areas of digital processes,
helping to rationalize processes and controls,
with strong analytics and data control. Equal
reduce unprofitable products and services, and
attention must be given to the “hard” components
consolidate risk assessments. The path ultimately
of these changes—analytics engines and data
supports better institutional performance, including
Scan • Download • Personalize infrastructure—and to the “soft” ones as well—the
fewer losses experienced and reduced capital
upskilling of people.
requirements for potential large, idiosyncratic
events. Successful institutions able to focus The CROs of leading banks are increasingly seeing
on positive outcomes are more productive and the risk function’s role as central to institutional
more responsive to all stakeholders—customers, strategy and resilience building. Progress toward
investors, and regulators. this shift—to a holistic resilience function with a
strategic role—has accelerated under the stress
of simultaneous crises. Risk is able to anticipate
CROs’ future priorities
evolving trends in the economic and regulatory
CROs are preparing for the future by leading a environment and identify emerging threats.
number of long-term efforts simultaneously. They Foresight in traditional focus areas for banking as
are seeking to deepen and accelerate the digital well as in newer topics such as ESG, cyber, and
transformation of the function, to win the war for geopolitical changes creates potential first-mover
risk talent, and to build state-of-the art expertise advantages. Only by locating risk within institutional
in regulation, cybersecurity, analytics, and digital strategy will banking CEOs and CROs be able
innovation. Rather than seeing fintechs and other to exploit such valuable intelligence. In times of
new entrants as adversarial threats, for example, crisis, resilient organizations find the ways to make
forward-looking risk leaders are embracing the consequential moves early and accelerate into the
new approaches. They are designing digital and new realities. As conditions improve, they can shift
lean transformations within the bank to become into growth faster than those they left behind.
catalysts for innovation, possibly including

Marc Chiapolino is a partner in McKinsey’s Paris office, Filippo Mazzetto is an associate partner in the Milan office, Thomas
Poppensieker is a senior partner in the Munich office, Cécile Prinsen is an expert in the London office, and Dan Williams is a
partner in the Washington, DC, office.

Designed by McKinsey Global Publishing

Copyright © 2022 McKinsey & Company. All rights reserved.

6 Risk and resilience priorities, as told by chief risk officers