The future of non-financial risk in financial services

Financial institutions need to implement a holistic risk management framework that includes a comprehensive risk taxonomy describing different types of risks, and a robust risk identification process to assess and mitigate non-financial risk across all lines of defense.

Institutions will need to move from the current piecemeal efforts to instead adopt a holistic approach to NFR. The foundation of an effective program to manage NFR, and a step that presents a challenge for many institutions, is to implement a comprehensive process to identify all the NFRs facing the organization. In this effort and as a first step, institutions should employ a comprehensive Risk Taxonomy and a comprehensive Risk Identification process.

As financial institutions develop their overall approach to managing NFRs, they should consider carefully the following four key levers to achieve success in today’s risk management environment.

• Strategy: Institutions require a clear process and explicit ownership to incorporate all material NFRs into their business strategies and risk appetite, while having in place appropriate metrics and risk limits.
• Three lines of defense: The three lines of defense risk governance model should be reassessed to clarify the responsibilities of each line of defense in managing NFR.
• People and culture: Many institutions will discover they need to hire or develop additional skills among their employees to address NFRs, such as in cyber risk, and also to build a culture, led by senior management, where employees throughout the organization recognize the importance of managing NFR.
• Emerging technologies: New technologies—such as big data, natural language processing, robotic process automation, and predictive analytics—should be leveraged to automatically scan a wider set of data sources to provide early warning signals of potential risk events while at the same time reducing compliance costs through automation.

Risk management today requires financial institutions take their programs to an entirely new level if they are to remain effective in a more unpredictable economic environment. Institutions that take these and the other steps discussed will be in a better position to manage NFR and meet increasing regulatory expectations in today's fast changing risk management environment.