From Fragmented Controls to Connected Risk

Current State: why this matters now

Non-financial risks are becoming more complex, visible and consequential. Regulatory expectations continue to increase, particularly in operational resilience, digital risk, outsourcing, data quality, financial crime, ESG and customer protection. At the same time, banks must demonstrate that they can identify, control and evidence these risks in an automated, consistent manner.

Most banks have already built strong foundations with control libraries, risk assessments, testing procedures, governance and reporting structures. However, these have expanded over time in response to regulatory change, resulting in an increasingly large and complex set of controls. The control environment can become overloaded, with fragmentation, duplication and overlap that limit oversight, obscure interdependence, increase testing and reporting burden, and make it harder to demonstrate genuine control.

This fragmentation matters because the impact of risk events is rarely limited to a single control area or risk type. A cyber incident can affect operational continuity, customer trust, regulatory attention and third-party dependencies—and may also create financial risk, such as increased credit risk if affected counterparties cannot meet obligations. Similarly, data quality issues can affect risk models, disclosures, regulatory submissions and downstream decisions across both financial and non-financial domains. A weakness in one control area can quickly cascade across the organisation.

Yet many banks still manage related risks through different methodologies, taxonomies, templates and systems. Related risks are assessed repeatedly, the same business lines provide overlapping evidence, and comparable controls exist in different parts of the organisation without being connected. Simply adding more people, assessments or reporting does not solve this—it adds bureaucracy, slows the business, and still leaves gaps in oversight, accountability and evidence. The opportunity is to build on what already exists while creating a more coherent Risk Control Framework.

Deloitte's Risk Control Framework 

Deloitte’s Risk Control Framework moves banks from fragmented activity to integrated, automated control governance. The shift is fundamental. Instead of strengthening controls one at a time, it treats riks and control as a single interconnected system – explicitly linking controls to regulations, processes, ownership and risk. That’s wat makes it relevant now, as expectations rise and risks grow more interdependent. It turns control from a compliance chore into a source of resilience, transparency, and better resilience. 

1. Effectiveness: Controls are proven to work through proportionate risk-based testing and root-cause analysis. No more routine pass-or-fail ticking; real, insight-driven assurance.
2. Substantiation: Testing outcomes, residual risks and Risk Appetite Statements feed directly into governance and reporting. This deliver credible, data-drive proof with end-to-end traceability from regulation to control to residual risk.
3. Rationalisation: Duplicate and dormant controls are stripped out, Less complexity, lower cost, less control fatigue, clearer ownership and easier automation of what actually matters.
4. Harmonisation: Controls are standardised in definition, approach and operating model across regions and business lines. One consistent wat to manage risk.

Each pillar supports the others. Implementation of controls without effectiveness testing creates uncertainty. Testing without substantiation creates weak evidence and does not build trust. Rationalisation without harmonisation may reduce consistency. Harmonisation without clear accountability results in a framework becoming a paper tiger.

Knowledge graphs as an enabler

The pillars define the goal. But their connected view is impossible to sustain by hand across thousands of controls, regulations and processes. This is where technology stops being optional.

Knowledge graphs make the connection real. They semantically link fragmented risk and control information into a living model of the non-financial risk environment, turning scattered data into genuine knowledge. A knowledge graph connects risks and controls to regulatory obligations, business processes, ownership, evidence and outcomes, and, crucially, shows how they relate. One caveat: those connections must be semantically validated against the real business rules of the risk domain, not just structurally plausible.

The payoff is a shift from static inventory to connected risk model. Banks can see which controls support multiple risks, which processes are most exposed, where the gaps are, and how one failure could ripple across the organisation.

Take that cyber incident again. In a knowledge graph, the compromised system is already linked, to the processes it supports, the controls meant to protect it, and the counterparties (and their credit exposures) that depend on it. When it hits, the chain lights up instantly. A control weakness in one domain traces straight through to credit risk in another. Gaps surface the same way: a critical process with no effective control shows up as a missing link, not a surprise in next year's audit.

_{Table 1: How knowledge graphs bring each pillar to life} 

The value of a knowledge graph is not any single capability, but the way it reinforces all four pillars at once. These graphs provide the modernisation layer, acting as the definitive map for AI to connect fragmented foundations—turning disparate data into an auditable, future-proof ecosystem and unlocking use cases like regulatory impact assessment, automated gap identification, and real-time reporting.

Final thoughts

For most banks, the biggest control weakness isn't a missing control, it's the missing connection between the controls they already have. Years of answering each new regulation with another control have built environments that are overloaded and blind at the same time.

So the question changes. The goal isn't a bigger control environment. It's a connected one, where every control traces to the risk it addresses, the regulation it satisfies, and the controls it depends on. Once that exists, the payoff is immediate: gaps become visible, duplication becomes removable, and evidence becomes something the system produces—not something teams scramble to assemble under deadline.

Our advice is deliberately counterintuitive: before adding a single new control, map what you already have and how it connects. Most banks will find they need fewer controls, not more, and the ones that remain will finally work as a system, not a collection. The banks that make this shift won't just satisfy supervisors more easily. They'll turn risk from a cost of doing business into a strategic asset—real insight into where they're actually exposed.

Let’s Talk

If the challenge of a control environment that keeps growing without becoming clearer is familiar within your organisation, the most useful first step is often the easiest: seeing how your existing controls, risks and regulations actually connect.

Deloitte can help you build that picture, using knowledge graphs to map your current control environment, surface the gaps and duplication hidden within it, and identify where connection would deliver the most value. Let's start with a conversation about where your control environment is most fragmented, and what a connected view could reveal.