Global Risk Productivity Survey Highlights Four Key Themes Shaping Risk Management

Banks’ second lines of defense continue to face expanding responsibilities as risk environments grow more complex. From financial exposures to third-party oversight, climate considerations, and cyber threats, risk functions are managing broader mandates while supervisory expectations continue to shift across jurisdictions.

According to McKinsey’s Global Risk Productivity Benchmark, banks are maintaining overall staffing and budgets within risk functions while reallocating resources to reflect automation and changing market conditions. The survey includes more than 40 global and regional banks, including 15 global systemically important institutions.

Risk Resources Remain Stable as Allocation Shifts

The survey shows that median full-time equivalent intensity has slightly declined, indicating stability in overall risk staffing. Cost levels have also remained steady.

At the same time, variability among institutions is narrowing. Banks below the median have increased staffing, while those above have streamlined resources.

Resource allocation is shifting within functions. Between 2020 and 2023, credit risk staffing declined by an average of 7% annually. This reflects increased automation and greater involvement from the first line of defense. Meanwhile, staffing in operational and market risk increased by 11% and 3% annually, respectively.

Expanding Scope Drives Operating Model Changes

Chief risk officers are expanding capabilities in nonfinancial risk areas and working more closely with the first line of defense. Technology-related threats remain a key concern, with 55% of organizations expecting major or severe disruption.

Banks are increasing resources in IT risk, cyber risk, third-party risk, and compliance. Growth in these areas has ranged from more than 40% to over 130% in recent years. Geopolitical and climate risks are also gaining attention, cited by about 40% and 30% of respondents.

Investment in enterprise risk management has increased by about 10%, alongside additional spending on nonfinancial and strategic risks.

Automation Reshapes Credit and Market Risk

Automation is reducing resource needs in retail credit risk. Time spent on credit risk activities has declined by more than 5% annually, driven by automation in approvals and loan processes.

As a result, about 75% of banks report fewer second-line roles in these areas. Resources are shifting to wholesale credit decisioning, which has grown by about 5% annually. Credit modeling and analytics teams have expanded by 10% annually.

Market risk teams are also growing, with staffing increases of less than 5% annually driven by data collection and analysis.

Regulatory Expectations Intensify

Supervisory expectations continue to evolve across regions. In Europe, regulators are increasing scrutiny on climate risk and data aggregation. In the United States, regulators have focused on remediation, although recent signals suggest a potential narrowing of requirements.

Operational risk remains under review. Capital requirements for operational risk increased by 15% in Europe between December 2022 and December 2024. These changes emphasize standardized approaches and strong data governance.

Supervisors are also demanding faster and more transparent reporting, including real-time insights and ad hoc stress testing.

Technology Adoption Accelerates

Technology adoption is expanding across risk functions. About 70% of institutions have implemented AI in credit decisioning and pricing proofs of concept. Additional use cases include fraud detection and portfolio monitoring.

As of mid-2024, only 15% of banks had fully developed AI use cases, though most have adopted data analytics tools. However, challenges remain, including data quality, privacy concerns, and uncertainty around use cases.

Banks are also allocating resources to technology, with some dedicating up to 200 hours annually to digital initiatives.

Organizational Models Continue to Evolve

Banks are adopting shared-service centers and centers of excellence to standardize processes and scale digital solutions. Offshoring is also expanding, with about one-third of banks using international hubs. These resources account for about 20% of total risk staffing on average.

At the same time, banks are streamlining organizational structures to reduce complexity and improve coordination.

Productivity Becomes a Key Differentiator

The survey indicates that productivity and effectiveness are becoming primary differentiators among risk functions. Institutions are focusing on automation, cost transparency, and structured use of AI.

As risk environments grow more complex, risk functions are balancing efficiency with the need to maintain human insight while continuing to adopt new technologies.