The future of non-financial risk in financial services

Risk management is at an inflection point with regulatory authorities placing greater emphasis on managing non-financial risks (NFR) such as non-compliance, misconduct, and cyber risk. Financial institutions need to implement a holistic risk management framework that includes a comprehensive risk taxonomy describing different types of risks, and a robust risk identification process to assess and mitigate non-financial risk across all lines of defense.

As financial institutions develop their overall approach to managing NFRs, they should consider carefully the following four key levers to achieve success in today’s risk management environment.

• Strategy: Institutions require a clear process and explicit ownership to incorporate all material NFRs into their business strategies and risk appetite, while having in place appropriate metrics and risk limits.
• Three lines of defense: The three lines of defense risk governance model should be reassessed to clarify the responsibilities of each line of defense in managing NFR.
• People and culture: Many institutions will discover they need to hire or develop additional skills among their employees to address NFRs, such as in cyber risk, and also to build a culture, led by senior management, where employees throughout the organization recognize the importance of managing NFR.

Emerging technologies: New technologies—such as big data, natural language processing, robotic process automation, and predictive analytics—should be leveraged to automatically scan a wider set of data sources to provide early warning signals of potential risk events while at the same time reducing compliance costs through automation.