Over the decades, the financial services industry has undergone a significant transformation due to internal and external factors, including business model transformation, the adoption of advanced technologies, changing regulatory environments, etc.

The modern banking sector is a highly complex ecosystem, where stakeholders of different backgrounds — internet, tech companies, startups — play an increasingly influential role.

In an increasingly complex environment of the financial services industry, new complexities arise, requiring an adjustment in risk management systems and procedures.

For financial institutions, expanding the array of risks that come with new types of players, new technologies, ever-growing complexities of national and international regulations, as well as changing consumer behavior, require significant resource investments to address financial and other risks naturally occurring as a result of those changes.

More than ever, chief risk and compliance officers play a critical role in monitoring and managing these risks to ensure a safe transformation of banking, and ensure continuity of their businesses.

In its simplest sense, risk could be defined as the uncertainty of an event to occur in the future. In the banking context, it’s the exposure to the uncertainty of an outcome, where exposure could be defined as the position/stake a bank takes in the market.

If history was any indication, banks have borne billions in losses due to imprudent risk-taking. It is hence vital to understand the different types of risks faced by every bank in 2018 and beyond.

• What are Some Risks in Modern Banking System?
• Risks Associated With Financial Markets
• How do you Manage Risk in the Banking Sector?
• The Future of Bank Risk Management

What are Some Risks in Modern Banking System?

Due to the large size of some banks, overexposure to risk can cause bank failure and impact millions of people. By understanding the risks posed to banks, governments can set better regulations to encourage prudent management and decision-making. The ability of a bank to manage risk also affects investors’ decisions.

Read Also: Five Ways the Banking Industry has been Transformed by IT

Even if a bank can generate large revenues, lack of risk management can lower profits due to losses on loans. Value investors are more likely to invest in a bank that is able to provide profits and is not at an excessive risk of losing money.

We have listed the major types of risks that are faced by every bank. They are as follows:

Credit Risks

Credit risk is the risk that arises from the possibility of non-payment of loans by the borrowers. Although credit risk is largely defined as risk of not receiving payments, banks also include the risk of delayed payments within this category.

Often times these cash flow risks are caused by the borrower becoming insolvent. Hence, such risk can be avoided if the bank conducts a thorough check and sanctions loans only to individuals and businesses that are not likely to run out of income over the period of the loan. Credit rating agencies provide adequate information to enable the banks to make informed decisions in this regard.

The profitability of a bank is extremely sensitive to credit risks. Hence, even if credit risk rises by a small amount, the profitability of the bank can get extremely impacted. Therefore, to deal with such risks banks have come up with a wide variety of measures. For instance, banks always hold a certain amount of funds in reserves to mitigate such risks.

The moment a loan is made, a certain amount of money is appropriated to the provision account. Also, banks have started utilizing tools like structured finance to mitigate such risks.

Securitization helps remove the concentrated risk from the bank’s books and diffuse it amongst the various investors in the capital markets. Credit derivatives like credit default swap have also come into existence to help banks survive in the event of a credit default.

Unpaid loans were, are and will always be a byproduct of conducting the banking business. Modern banks have realized this and are prepared to handle the situation without becoming insolvent until a catastrophic loss occurs.

Market Risks

Apart from making loans, banks also hold a significant portion of securities. Some of these securities are held because of the treasury operations of the bank i.e. as a means to park money for the short term.

However, many securities are also held as collateral based on which banks have given loans to their customers. The business of banking is therefore intertwined with the business of capital markets.

Banks face market risks in various forms. For instance if they are holding a large amount of equity then they are exposed to equity risk. Also, banks by definition have to hold foreign exchange exposing them to Forex risks. Similarly banks lend against commodities like gold, silver and real estate which exposes them to commodity risks as well.

In order to be able to mitigate such risks banks simply use hedging contracts. They use financial derivatives which are freely available for sale in any financial market. Using contracts like forwards, options and swaps, banks are able to almost eliminate market risks from their balance sheet.

Operational Risks

Banks have to conduct massive operations in order to be profitable. Economies of scale work in the favor of larger banks. Hence, maintaining consistent internal processes on such a large scale is an extremely difficult task.

Operational risk occurs as the result of a failed business processes in the bank’s day to day activities. Examples of operational risk would include payments credited to the wrong account or executing an incorrect order while dealing in the markets. None of the departments in a bank are immune from operational risks.

Operational risks arise mainly because of hiring the wrong people or alternatively they could also occur if there is a breakdown of the information technology systems. A lapse in the internal processes being followed could also lead to catastrophic errors.

For instance, Barings Bank ended up bankrupt because of its failure to implement appropriate internal controls. One trader was able to bet so much in the derivatives market that the equity of Barings Bank was wiped out and the bank simply ceased to exist.

Moral Hazard

The recent bailout of banks by many countries has created another kind of risk called the moral hazard. This risk is not faced by the bank or its shareholders. Instead, this risk is faced by the taxpayers of the country in which banks operate. Banks have become accustomed to taking excessive risk. If their risk pays off, they get to keep the returns.

However, if their risk backfires, then the losses are borne by taxpayers in the form of bailouts. This too big to fail model has caused banks to become reckless in their pursuit of profit.

Although central banks are using audits to ensure that safe business practices are followed, banks nowadays indulge in risky business the moment they are not under regulatory oversight.

Liquidity Risk

Liquidity risk is another kind of risk that is inherent in the banking business. Liquidity risk is the risk that the bank will not be able to meet its obligations if the depositors come in to withdraw their money. This risk is inherent in the fractional reserve banking system.

Therefore, in this system, only a percentage of the deposits received are held back as reserves, the rest are used to create loans. Therefore, if all the depositors of the institution came in to withdraw their money all at once, the bank would not have enough money. This situation is called a bank run. This has happened countless times over the history of modern banking.

Modern day banks are not very concerned about liquidity risk. This is because they have the backing of the central bank. In case there is a run on a particular bank, the central bank diverts all its resources to the affected bank.

Therefore, depositors can be paid back when they demand their deposits. This restores depositor’s confidence in the banks finances and the run on the bank is averted.

Many modern day banks have faced bank runs. However, none of them have become insolvent due to a bank run post the establishment of central banks.

Business Risk

The banking industry today is considerably advanced and diversified. Banks today have a wide variety of strategies from which they have to choose. Once such strategy is chosen, banks need to focus their resources on obtaining their strategic goals in the long run.

Hence, there is always a risk that a given bank may choose the wrong strategy. As a result of this wrong choice, the bank may suffer losses and end up being acquired or may simply collapse. Consider the case of banks such as Washington Mutual and Lehman Brothers.

These banks chose the subprime route to growth. Their strategy was to be the preferred lender to people who have less than perfect credit scores. However, the whole area of subprime lending went bust and since these banks had heavy exposures to such loans, they suffered dire consequences too.

Banks have no possible way to mitigate the risks that are created by following inappropriate business objectives. Which objectives were right and which were wrong? This question can only be answered in hindsight. When Lehman Brothers was focusing their resources on subprime lending, it must have seemed like the strategically right thing to do!

Reputational Risk

Reputation is an extremely important intangible asset in the banking business. Banks like JP Morgan bank, Chase bank, Citibank, Bank of America etc have all been in the business for hundreds of years and have stellar reputations. These reputations enable them to generate more business more profitably.

Customers like their money to be deposited at places which they believe follow safe and sound business practices. Hence, if there is any news in the media which projects a given bank in a negative light, such news negatively impacts the banks business.

For instance Citibank was recently viewed as manipulating the Forex rates via conducting false trades with its own trading partners. When regulators found out about Citibank’s predatory tactics, they levied huge fines on the bank.

Apart from the fines Citibank also lost reputation as a bank that follows fair trade practices when the customers found out that they tend to resort to market manipulation. Many prospective customers may have shifted their business away from Citibank as a result of this discovery causing monetary loss as a result of reputation loss.

Banks can save their reputation by ensuring that they never participate in any unfair or manipulative business practices. Also, banks need to continuously ensure that their public relations efforts project them as a friendly and honest bank.

Systemic Risk

Systemic risk arises because of the fact that the financial system is one intricate and connected network. Hence, the failure of one bank has the possibility to cause the failure of many other banks as well. This is because banks are counterparties to each other in a lot of transactions. Hence, if one bank fails, the credit risk event for the other banks becomes a reality.

They have to write off certain assets as a result of the failure of their counterparty. This writing off often leads to the bankruptcy of other banks and an unstoppable domino seems to take over.

Systemic risk is an extremely bad scenario to be in. For instance when the subprime crisis happened in 2008, it seemed like the entire global financial system would collapse.

The very nature of banking system therefore makes them prone to systemic risks. Systemic risks do not affect an individual bank rather they affect the entire system. Hence, there is very little that an individual bank can do to protect itself in the event that such a risk materializes.

Thus, the management of banks requires a lot of skill since multiple types of risks need to be mitigated. Some of these risks can be avoided whereas for the others the best that banks can do is to minimize their damage.

Risks Associated With Financial Markets

Risk is a term often heard in the world of investing, but it is not always clearly defined. It can vary by asset class or financial market and the list of risks include default risks, counterparty risks, and interest rate risks. 

Volatility is sometimes used interchangeably with risk, but the two terms have very different meanings. Furthermore, while some risks relate to just one company, others are relevant for specific industries, sectors, or even entire economies.

Systemic and Non-Systemic Risk

Risks are typically one of two types: systemic or non-systemic. Systemic risk is one that happens within a company or group of companies that can create havoc throughout an entire industry, sector, or economy.

The financial crisis of 2007-2008 is an example, as a handful of large institutions threatened the entire financial system. This gave rise to the adage “too big to fail” because many of the large banks were deemed too important and thus needed a bailout from the U.S.

Non-systemic risk relates to one party or company and is also called unsystematic or diversifiable risk. For example, a company might face risks of substantial losses due to legal proceedings.

If so, the shares might be vulnerable if the company loses a lot of money due to an adverse court ruling. This risk is likely to impact just one company and not an entire industry. It is said that the diversification of a portfolio is the best way to mitigate non-systemic risk.

Volatility

Volatility is the speed of movement in the price of an asset. A higher level of volatility indicates larger moves and wider changes in the value of an asset. 

Volatility is a non-directional value—a higher volatility asset has an equal likelihood of making a larger move up as it does down, which means they have a larger impact on the value of a portfolio. Some investors like volatility, while others try to avoid it as much as possible. Either way, a high volatility instrument carries greater risk in down markets because it suffers greater losses than the low volatility asset.

Counterparty Risk

Counterparty risk is the possibility that one party of a contract defaults on an agreement. It is a risk, for example, in a credit default swap instrument. Credit swaps represent the exchange of cash flows between two parties and are typically based on changes in the underlying interest rates. Counterparty defaults on swap agreements were one of the main causes of the 2008 financial crisis.

Counterparty risk can also be a factor when dealing with other derivatives such as options and futures contracts, but the clearinghouse will ensure the terms of a contract are fulfilled if one of the parties runs into financial problems. Counterparty risk can affect bond, trading transactions, or any instrument where one party depends on another to fulfill financial obligations.

Default Risk and Interest Rate Risk

Default risk is most often associated with bond and fixed income markets. It is the risk that a borrower may default on its loan obligations and not pay the lender outstanding amounts. Generally, a higher possibility of default results in a larger amount of interest paid on a bond. Thus, there is a risk/reward tradeoff investors must consider when looking at yields on bonds.

Interest rate risk refers to the potential losses in investment due to increasing interest rates. It is most notable when investing with bonds, as the price of a bond typically falls as interest rates rise.

That’s because bonds pay a fixed percentage rate and, as interest rates rise, existing bonds must compete with newer bonds that will be issued at higher rates. In order to do so, the price of the older bond must drop, and that is the risk of holding bonds as rates increase.

How do you Manage Risk in the Banking Sector?

Financial establishments, such as banks, routinely face different types of risks in the course of their operations. Risk stems from uncertainty of financial loss and can potentially cripple the business if not managed in time.

This demands that mechanisms to manage risk be created via a risk management philosophy, with the objective of minimizing negative effects risks can have on the financial health of the institution. This involves identifying potential risks in advance, analyzing them and taking steps to diminish or eliminate them.

Market Risk

Financial institutions face the possibility of loss caused by changes in market variables, including interest rate and exchange rate fluctuations, as well as movements in market prices of commodities, securities and financial derivatives. These constitute risks that can negatively impact the financial capital of the institution.

Market risk management involves developing a comprehensive and dynamic framework for monitoring, measuring and managing liquidity, interest rate, foreign exchange and commodity price risks. This should be integrated with the institution’s business strategy. In addition, stress testing can assess potential problem areas in a given portfolio.

Credit Risk

Credit risk is the potential that an entity that borrowed money will default on that obligation to the financial institution. It may be because of the inability or unwillingness of the client to honor their part of the bargain in relation to the financial transaction.

To manage credit risk, the institution has to maintain credit exposure within acceptable parameters. One effective way is via a risk rating model that gauges how much a bank stands to lose on a credit portfolio. Further, lending decisions are routinely based on the credit score and report of the prospective borrower.

Operational Risk

Operational risk is associated with the potential negative consequences of the operations of the financial institution, such as those caused by inadequate or failed internal processes, people and systems, or unforeseeable external events. Internal operational risks include omissions in the work of employees, inadequate information management and losses arising from fraud, trading errors or system failures.

External events such as floods, fire and natural disasters also pose risks. Operational risk management involves establishing internal audit systems, assessing and eliminating weak control procedures, familiarizing all levels of staff with complex operations and having appropriate insurance cover.

Regulatory Risk

All financial institutions face regulatory risk, since the U.S. has several financial regulations implemented at federal and state levels that have to be complied with.

This is to enhance governance and safeguard the public against loss. Banks and other financial establishments that have gone for public issue face a multiplicity of regulatory controls in order to ensure greater responsibility and accountability.

These regulations can inhibit the free growth of the business as institutions focus on compliance, leaving little energy and time for developing new business. To manage regulatory risk, institutions should conduct their business activities within the regulatory framework.

The Future of Bank Risk Management

Risk management in banking has been transformed over the past decade, largely in response to regulations that emerged from the global financial crisis and the fines levied in its wake. But important trends are afoot that suggest risk management will experience even more sweeping change in the next decade.

The change expected in the risk function’s operating model illustrates the magnitude of what lies ahead. Today, about 50 percent of the function’s staff are dedicated to risk-related operational processes such as credit administration, while 15 percent work in analytics. McKinsey research suggests that by 2025, these numbers will be closer to 25 and 40 percent, respectively.

No one can draw a blueprint of what a bank’s risk function will look like in 2025—or predict all forthcoming disruptions, be they technological advances, macroeconomic shocks, or banking scandals. But the fundamental trends do permit a broad sketch of what will be required of the risk function of the future.

The trends furthermore suggest that banks can take some initiatives now to deliver short-term results while preparing for the coming changes. By acting now, banks will help risk functions avoid being overwhelmed by the new demands.

Six trends

Six trends are shaping the role of the risk function of the future.

Trend 1: Regulation will continue to broaden and deepen

While the magnitude and speed of regulatory change is unlikely to be uniform across countries, the future undoubtedly holds more regulation—both financial and nonfinancial—even for banks operating in emerging economies.

Much of the impetus comes from public sentiment, which is ever less tolerant of bank failures and the use of public money to salvage them. Most parts of the prudential regulatory framework devised to prevent a repetition of the 2008 financial crisis are now in place in financial markets in developed economies.

But the future of internal bank models for the calculation of regulatory capital, as well as the potential use of a standardized approach as a floor (Basel IV), is still being decided. The proposed changes could have substantial implications, especially for low-risk portfolios such as mortgages or high-quality corporate loans.

Governments are exerting regulatory pressure in other forms, too. Increasingly, banks are being required to assist in crackdowns on illegal and unethical financial transactions by detecting signs of money laundering, sanctions busting, fraud, and the financing of terrorism, and to facilitate the collection of taxes.

Governments are also demanding that their banks comply with national regulatory standards wherever they operate in the world.

Banks operating abroad must already adhere to US regulations concerning bribery, fraud, and tax collection, for example. Regulations relating to employment practices, environmental standards, and financial inclusion could eventually be applied in the same way.

Banks’ behavior toward their customers is also under scrutiny. The terms and conditions of contracts, marketing, branding, and sales practices are regulated in many jurisdictions, and rules to protect consumers are likely to tighten.

Banks will probably be closely examined for information asymmetries, barriers to switching banks, inappropriate or incomprehensible advice, and nontransparent or unnecessarily complex product features and pricing structures. The bundling and cross-subsidizing of products could also become problematic.

In certain cases, banks might even be obliged to inform their customers of more suitable products with better terms than the ones they have—such as a lower remortgage rate. (Utility suppliers in some markets are already obliged to do this.)

This tightening regulatory environment makes unviable the traditional model to manage regulatory risks; the risk function will need to build even more robust regulatory and stakeholder-management capabilities.

Risk functions must not only ensure compliance with existing rules but also review the entire sales-and-service approach through a broad, principle-based lens.

In addition, the risk function will play a vital role in collaborating with other functions to reduce risk—for example, by working more closely with the business to integrate and automate the correct behaviors and to eliminate human interventions.

The risk function’s tasks will be to ensure that compliance considerations are always top of mind and not addressed perfunctorily by businesses after they have formulated their strategies or designed a new product.

Trend 2: Customer expectations are rising in line with changing technology

Technological innovation has ushered in a new set of competitors: financial-technology companies, or fintechs. They do not want to be banks, but they do want to take over the direct customer relationship and tap into the most lucrative part of the value chain—origination and sales.

In 2014, these activities accounted for almost 60 percent of banks’ profits. They also earned banks an attractive 22 percent return on equity, much higher than the gains they received from the provision of balance sheet and fulfillment, which generated a 6 percent return on equity.

The seamless and simple apps and online services that fintechs offer are beginning to break banks’ heavy gravitational pull on customers. Most fintechs start by asking customers to transfer a single piece of their financial business, but many then steadily extend their services.

If banks want to keep their customers, they will have to up their game, as customers will expect intuitive, seamless experiences, access to services at any time on any device, personalized propositions, and instant decisions.

Banks’ responses to higher customer expectations will be automated: an instant response to retail and corporate credit decisions, for example, and a simple, rapid online account-opening process. For banks to deliver at this level, they will have to be redesigned from the perspective of customer experience and then digitized at scale.

Fintechs such as Kabbage, a small-business lender that operates in the United Kingdom and the United States, set a high customer-service bar for banks—and present new challenges for their risk functions. Kabbage does not require loan applicants to fill out lengthy documents to establish creditworthiness.

Instead, it draws upon a wide range of customer information from data sources such as PayPal transactions, Amazon and eBay trade information, and United Parcel Service shipment volumes. While it remains to be seen how such fintechs perform in the longer term, banks are learning from them.

Some are designing account-opening processes, for example, where most of the requested data can be drawn from public sources. The risk function will have to work closely with each business to meet these kinds of customer expectations while containing risk to the bank.

Technology also enables banks and their competitors to offer increasingly customized services. It may be possible eventually to create the “segment of one,” tailoring prices and products to each individual.

This degree of customization is expensive for banks to achieve because of the complexity of supporting processes. Regulatory constraints might well be imposed in this area, however, to protect consumers from inappropriate pricing and approval decisions.

To find ways to provide these highly customized solutions while managing the risk will be the task of the risk function, working jointly with operations and other functions. Risk management will need to become a seamless, instant component of every key customer journey.

Trend 3: Technology and advanced analytics are evolving

Technological innovations continuously emerge, enabling new risk-management techniques and helping the risk function make better risk decisions at lower cost. Big data, machine learning, and crowdsourcing illustrate the potential impact.

• Big data. Faster, cheaper computing power enables risk functions to use reams of structured and unstructured customer information to help them make better credit risk decisions, monitor portfolios for early evidence of problems, detect financial crime, and predict operational losses. An important question for banks is whether they can obtain regulatory and customer approval for models that use social data and online activity.
• Machine learning. This method improves the accuracy of risk models by identifying complex, nonlinear patterns in large data sets. Every bit of new information is used to increase the predictive power of the model. Some banks that have used models enhanced in this way have achieved promising early results. Since they cannot be traditionally validated, however, self-learning models may not be approved for regulatory capital purposes. Nevertheless, their accuracy is compelling, and financial institutions will probably employ machine learning for other purposes.
• Crowdsourcing. The Internet enables the crowdsourcing of ideas, which many incumbent companies use to improve their effectiveness. Allstate Insurance Company hosted a challenge for data scientists to crowdsource an algorithm for new car-accident insurance claims. Within three months, they improved the predictive power of their model by 271 percent.

Many of these technological innovations can reduce risk costs and fines, and they will confer a competitive advantage on banks that apply them early and boldly.

However, they may also expose institutions to unexpected risks, posing more challenges for the risk function. Data privacy and protection are also important concerns that must be addressed with due rigor.

Trend 4: New risks are emerging

Inevitably, the risk function will have to detect and manage new and unfamiliar risks over the next decade. Model risk, cybersecurity risk, and contagion risk are examples that have emerged.

• Model risk. Banks’ increasing dependence on business modeling requires that risk managers understand and manage model risk better. Although losses often go unreported, the consequences of errors in the model can be extreme. For instance, a large Asia–Pacific bank lost $4 billion when it applied interest-rate models that contained incorrect assumptions and data-entry errors. Risk mitigation will entail rigorous guidelines and processes for developing and validating models, as well as the constant monitoring and improvement of them.
• Cybersecurity risk. Most banks have already made protection against cyberattacks a top strategic priority, but cybersecurity will only increase in importance and require ever greater resources. As banks store an increasing amount of data about their customers, the exposure to cyberattacks is likely to further grow.
• Contagion risk. Banks are more vulnerable to financial contagion in a global market. Negative market developments can quickly spread to other parts of a bank, other markets, and other involved parties. Banks need to measure and track their exposure to contagion and its potential impact on performance. Measures to reduce a bank’s total risk can reduce its capital requirements, as contagion risk is one of the main drivers for classification as a global systemically important bank (G-SIB) and for G-SIB capital surcharges.

To prepare for new risks, the risk-management function will need to build a perspective for senior management on risks that might emerge, the bank’s appetite for assuming them, and how to detect and mitigate them. And it will need the flexibility to adapt its operating models to fulfill any new risk activities.

Trend 5: The risk function can help banks remove biases

Behavioral economics has made great strides in understanding how people make decisions guided by conscious or unconscious biases. It has shown, for example, that people are typically overconfident—in a few well-known experiments, for example, enormous majorities of respondents rated their driving skills as “above average.”

Anchoring is another bias, by which people tend to rely heavily on the first piece of information they analyze when forming opinions or making decisions.

Business, too, is prone to bias. Business cases are almost always inflated, and if the first person to speak in a discussion argues in favor of an idea, the likelihood is high that most present, if not all, will agree.

Biases are highly relevant for bank risk-management functions, as banks are in the business of taking risk, and every risk decision is subject to biases. A credit officer might write on a credit application, for example, “While the management team only recently joined the company, it is very experienced.” The statement may simply be true—or it may be an attempt to neutralize potentially negative evidence.

Leading academics and practitioners have developed techniques for overcoming such biases, and various industries are beginning to apply them. Some energy utilities are trying to eliminate bias by redesigning the processes they follow in making major investment decisions, for example.

Banks are also likely to deploy techniques to remove bias from decision making, including analytical measures that provide decision-makers with more fact-based inputs, debate techniques that help remove biases from conversations and decisions, and organizational measures that embed new ways of decision making.

The risk function could take the lead in de-biasing banks. It could even become a center of excellence that rolls out de-biasing processes and tools to other parts of the organization.

Trend 6: The pressure for cost savings will continue

The banking system has suffered from slow but constant margin decline in most geographies and product categories. The downward pressure on margins will likely continue, not least because of the emergence of low-cost business models used by digital attackers.

As a result, the operating costs of banks will probably need to be substantially lower than they are today. After exhausting traditional cost-cutting approaches such as zero-based budgeting and outsourcing, banks will find that the most effective remaining measures left are simplification, standardization, and digitization.

The risk function must play its part in reducing costs in these ways, which will also afford opportunities to reduce risks. A strong automated control framework, for example, can reduce human intervention, tying risks to specific process break points.

As the pressure to reduce costs will persist, the risk function will need to find further cost-savings opportunities in digitization and automation while delivering much more for much less.

Preparing for change

The six trends suggest a vision for a high-performing risk function come 2025. It will need to be a core part of banks’ strategic planning, collaborate closely with businesses, and act as a center of excellence in analytics and de-biased decision making.

Its ability to manage multiple risk types while complying with existing regulation and preparing for new rules will make it more valuable still, while its role in fulfilling customer expectations will probably render it a key contributor to the bottom line.

Read Also: Innovation in the Banking System of the United States in the Digital Age

For most banks, their risk function is some way off from being able to play that role. The optimal function would have the following attributes and capabilities:

• full automation of decisions and processes with minimal manual interventions
• increased reliance on advanced analytical models to de-bias decisions
• close collaboration with businesses and other functions to provide a better customer experience, de-biased decisions, and enhanced regulatory preparedness
• strong advocacy of corporate values and principles, supported by a robust risk culture that is clearly defined, communicated, and reinforced throughout the bank
• a talent pool with superior advanced-analytics capabilities

To put all this in place, risk functions will need to transform their operating models. How can they begin? They cannot prepare for every eventuality, but initiatives can be implemented that will bring short-term business gains while helping build the essential components of a high-performing risk function over the next decade. Here are some examples of such initiatives that can be launched immediately:

• Digitize core processes. Simplification, standardization, and automation are key to reducing nonfinancial risk and operating expenses. To that end, the risk function can help speed the digitization of core risk processes, such as credit applications and underwriting, by approaching businesses with suggestions rather than waiting for the businesses to come to them. Increased efficiency, a superior customer experience, and improved sales will likely be additional benefits.
• Experiment with advanced analytics and machine learning. In the same vein, risk functions should experiment more with analytics, and particularly machine learning, to enhance the accuracy of their predictive models. Risk functions can be expected to use these models for a number of purposes, including financial-crime detection, credit underwriting, early-warning systems, and collections in the retail and small-and-medium-size-enterprise segments.
• Enhance risk reporting. Ever-broader regulation and the need to adjust to market developments require rapid, fact-based decision making, which means better risk reporting. While regulatory requirements have already done much to improve the quality of the data used in risk reports and their timeliness, less attention has been given to the format of reports or how they could be put to better use for making decisions. Replacing paper-based reports with interactive tablet solutions that offer information in real time and enable users to do root-cause analyses would enable banks to make better decisions faster and to identify potential risks more quickly as well.
• Collaborate for balance-sheet optimization. Given regulatory constraints, balance-sheet composition is arguably more important than ever in supporting profitability. The risk function can help optimize the asset and liability composition of the balance sheet by working with finance and strategy functions to consider various economic scenarios, regulation, and strategic choices. How prepared would the bank be, for example, if the loan portfolio were contracted or expanded? Such analyses, optimized with analytical tools, can help banks find ways to improve returns on equity by 50 to 400 basis points, while still fulfilling all regulatory requirements.
• Refresh the talent pool. High-performing risk functions commonly depend on a high-performing IT and data infrastructure—a central “data lake” with harmonized definitions and clear data governance, for example. Building the right mix of talent is equally important. Data scientists with advanced mathematical and statistical knowledge are needed to collaborate across the bank in the conversion of data insights into business actions. Risk managers will become trusted counselors to business areas, while traditional operational areas will require fewer staff. Attracting talented employees will itself be a challenge, as potential candidates would tend to prefer technology firms unless banks strengthen their value propositions.
• Build a strong risk-management culture. The detection, assessment, and mitigation of risk must become part of the daily job of all bank employees and not only those in risk functions. With automation and more sophisticated analytical and technical capabilities, human intervention is needed to ensure appropriate and ethical application.

The risk function will have a dramatically different role by 2025. To get there, needed changes will take several years, so time is already short. The actions recommended here can equip the risk function with the capabilities it needs to cope with new demands and help the bank to excel among its competitors.