Skip to main content

The future of non-financial risk in financial services

Building an effective non-financial risk management program

Risk management is at an inflection point with regulatory authorities placing greater emphasis on managing non-financial risks (NFR) such as non-compliance, misconduct and cyber risk. 

Financial institutions need to implement a holistic risk management framework that includes a comprehensive risk taxonomy describing different types of risks and a robust risk identification process to assess and mitigate non-financial risk across all lines of defense.

Institutions will need to move from the current piecemeal efforts to instead adopt a holistic approach to NFR. The foundation of an effective programme to manage NFR and a step that presents a challenge for many institutions, is to implement a comprehensive process to identify all the NFRs facing the organisation. In this effort and as a first step, institutions should employ a comprehensive Risk Taxonomy and a comprehensive Risk Identification process.

As financial institutions develop their overall approach to managing NFRs, they should consider carefully the following four key levers to achieve success in today’s risk management environment.

  • Strategy: Institutions require a clear process and explicit ownership to incorporate all material NFRs into their business strategies and risk appetite, while having in place appropriate metrics and risk limits.
  • Three lines of defence: The three lines of defence risk governance model should be reassessed to clarify the responsibilities of each line of defense in managing NFR.
  • People and culture: Many institutions will discover they need to hire or develop additional skills among their employees to address NFRs, such as in cyber risk, and also to build a culture, led by senior management, where employees throughout the organisation recognise the importance of managing NFR.
  • Emerging technologies: New technologies—such as big data, natural language processing, robotic process automation and predictive analytics—should be leveraged to automatically scan a wider set of data sources to provide early warning signals of potential risk events while at the same time reducing compliance costs through automation.

Risk management today requires financial institutions take their programmes to an entirely new level if they are to remain effective in a more unpredictable economic environment. Institutions that take these and the other steps discussed will be in a better position to manage NFR and meet increasing regulatory expectations in today's fast changing risk management environment.

Did you find this useful?

Thanks for your feedback

If you would like to help improve Deloitte.com further, please complete a 3-minute survey