RISK LEADERSHIP – CHANGING THE PARADIGM COMPETENCY PROFILING IN A BANKING INDUSTRY SUSCEPTIBLE TO DISRUPTION
2
3
Oliver Wyman recently undertook a survey to benchmark the competencies of those managing and leading the Risk function in banks based in Europe. The aims were to capture information about disruptive trends in the banking industry and to understand which actions might enable Risk functions to respond to these trends. The results of our survey suggest that major shifts in competencies are required to prepare the Risk function and its leadership teams for the changes to come. We argue that a fundamental disruption will be required as a foundation for success over the next five to ten years. This report outlines how Risk leaders can prepare for this challenge.
RISK LEADERSHIP – CHANGING THE PARADIGM
4
On a Saturday afternoon in September 2025, Chris is at his favorite café. Although quite busy
in his professional life as the Chief Risk Officer (CRO) of TradBank, he occasionally sets
aside time to enjoy relaxing moments like this to reflect on his career and his leadership team.
While vacantly looking at cheerful customers coming into the café, he recognized Joanne,
an old university friend he has not spoken to since graduation. He has been keen to catch up
with Joanne, especially since her appointment as the CRO at DisruptBank a few years ago.
Joanne’s face lights up when she sees Chris waving; the two grab a table and start chatting.
SEPTEMBER 2025: TWO CROs WALK INTO A CAFÉ
5
DisruptBank seems to be doing well! What’s the secret to your success?
Good one! A mix of ingredients, I’d say. Most importantly, I worked
in the business so I understand our colleagues, their language,
and the big picture. My experience at Google came in handy during
the digital revolution era. I think that CROs need a wide-ranging set
of competencies in this ever-changing world.
Interesting. I disagree, though. I wouldn’t claim that experience with
the business or Google is vital. I rely on my IT team for all things digital.
But being an absolute expert in all risk types and risk modelling is critical.
I disagree. I don’t need to understanding the modelling in detail.
It’s more important to grasp technology so we’re confident steering
through the evolving digital landscape.
But help me understand where you’re coming from. Which
competencies will be important to you?
My expertise in both credit and market risk. Without it, I couldn’t do my
job or interact with regulators. In my world, that’s the key to success.
For me, a broad but sound understanding across all types of risk
is more important than deep expertise in just one of them. The regulator
no longer drives our agenda, and the management of credit and
market risk is largely commoditized.
Seriously? I couldn’t disagree more. In my world, having in-depth
expertise is fundamental.
Granted, the “right” set of competencies is determined by the world
we live in. My world is a disrupted banking world, and I wouldn’t survive
with expertise in just one area of risk.
But tell me, what would you have done if the industry were fundamentally
disrupted in your world like it is in mine? Would your approach
have survived the disruption? I think I could live in your traditional world
just as well as I do in my disrupted world.
Chris
Joanne
6
DisruptBank and TradBank operate in two different environments. In each of these, the
banking industry panned out quite differently over the previous decade, and Risk functions
adapted their operating models accordingly. Exhibit 1 summarizes the two environments.
After recovering from the amusing coincidence that both of them hold CRO positions,
Chris and Joanne are drawn into a debate about their careers and experiences.
Joanne and Chris have reacted very differently in their respective environments. Consequently,
two very distinct styles of Risk functions and leadership teams have evolved. Joanne emphasizes
qualities such as strategic thinking, digital savviness, talent management, and communication.
For Chris, the focus is on stakeholder management, analytical aptitude, and market insights.
Exhibit 2 illustrates these differences in a number of areas. We based Chris and Joanne’s
profiling on Oliver Wyman’s Risk Leadership Competency Framework.
The Oliver Wyman Risk Leadership Framework helps to assess the competency profile of CROs
and their direct reports across four dimensions. We introduce the framework on page 13
in more detail.
Exhibit 1: State of the banking industry in 2025
AREA DISRUPTED ENVIRONMENT TRADITIONAL ENVIRONMENT
Macro- economics
• Long-term continuation of economic malaise • Increasing pressure on efficiency
• Regular five- to eight-year boom–bust cycle returns • Focus on enabling growth rather than efficiency
Technology • Customers embrace tech • Tech development grows faster outside banks than in–house • Tech providers remain largely unregulated or under-regulated compared to banks • Modularization takes off
• Tech advancement is slower than expected • High barriers of entry and cultural rejection limit the scale of challengers
Regulatory environment
• Shift towards deregulation and simplified standard approaches • Tech providers are encouraged to enter the market
• Continued regulatory scrutiny • Regulatory activities remain resource-intensive • Balkanization of regulatory regimes and protectionism • Tech providers come under increased regulatory scrutiny
Risk environment • New non-financial risks enter the centre stage; management of traditional risks (e.g. credit risk, market risk, etc.) is largely automated • Incumbent banks are disadvantaged by legacy systems and approaches
• New risks do not materialize in unexpected ways • Incumbent banks are seen as more reliable in managing new risks
Operating model
• Risk systems and IT are largely outsourced and core processes or approaches commoditized • Blurred distinction between first and second lines of defence (1st LoD and 2nd Lod) as Risk defines many of the 1st LoD decision-making algorithms • Flatter hierarchies; Risk works side-by-side with the 1st LoD in an agile working model
• Banks adopt tech in-house; Risk IT becomes an integral part of Risk • Automation of credit decisions has progressed but distinction between 1st and 2nd LoD remains strong • An agile operating model is not widely adopted
7
Exhibit 2: Competency profiling: Joanne (CRO, DisruptBank) vs Chris (CRO, TradBank)
Strategic thinking/big picture focus
Digital aptitude
Market insight
Change leadership
Results focused
Change execution
Knowledge acquisition and creation
Analytical aptitude
Culture
Motivation
Communication
Stakeholder management
Self-awareness andwillingness to grow
Positive example
Talent management
Team management
Joanne
Chris
Managing people
Influencing
Strategic
Operational
Strategic thinking/big picture focus
Digital aptitude
Market insight
Change leadership
Results focused
Change execution
Knowledge acquisition and creation
Analytical aptitude
Culture
Motivation
Communication
Stakeholder management
Self-awareness andwillingness to grow
Positive example
Talent management
Team management
Joanne
Chris
Managing people
Influencing
Strategic
Operational
8
HOW ONE GROCER PACKED MORE PUNCH INTO THEIR STORES
A major European grocer wanted to dedicate more space to categories identified as being
important to attracting customers to the store, and at the same time increase basket sizes by
introducing entirely new categories. Both of these require more space: by applying an approach
similar to that described here, the retailer was able to condense the rest of the assortment to
provide it.
First, the retailer strengthened its ranges by eliminating duplication, and adding new lines which
commanded real customer loyalty. A new ranging tool, which modeled the switchability of
demand across items, meant buyers could estimate the net sales gains from adding or removing
products. By allowing them to develop stronger planograms in an efficient, scalable way, it
produced space productivity gains of over 4% in the retailer’s mature stores.
Second, the retailer looked for opportunities to “squeeze” categories with lower productivity. By
comparing choice and space elasticity data across different areas of the store and taking its long-
term objectives for each category into consideration, the retailer found opportunities to free up
additional shelf space by removing entire bays of slow-selling products in many categories.
Third, the retailer reviewed shelf stocking rules to identify and eliminate “spare” space in each
bay, comparing operating practices with rate of sale data, and understanding where stores
were and weren’t complying with the old guidelines. Removing unnecessary facings across the
whole store allowed the same assortment to be condensed into around 3% less space, freeing up
additional shelf bays for new categories.
The overall impact of these initiatives was strongly positive: the retailer was able to condense a
more powerful assortment into significantly less space, and achieve an improvement in space
productivity of over 10%, as shown in Exhibit 3.
CASE STUDY
“Talent management has historically been underemphasized – particularly in Risk. If we do not invest
today and up our game, we will have structural problems in the near future. In particular, we find
ourselves competing with a set of new market participants, which historically weren’t relevant for us,
amongst them FinTechs and technology companies such as the Googles and Apples of this world.
The skills are essentially the same!”
CRO, Regional retail bank
BACKGROUND TO THE RISK LEADERSHIP COMPETENCY BENCHMARKING SURVEY
During the first six months of 2017, Oliver Wyman undertook a survey
to benchmark the competencies of Risk function leaders in the European
banking industry.
AIMS OF THE SURVEY
• Capture information about potentially disruptive trends
in the operating models of Risk functions
• Identify the changes that Risk leadership teams would need to make
to their competency profile to enable them to respond to those trends
GEOGRAPHIC SCOPE
• More than 20 interviewees: more than 15 Group CROs and
additional Risk leadership team members of financial institutions
across Europe
PARTICIPANTS
• Global and domestic systemically important banks (G-SIBs and D-SIBs)
• International wholesale and retail banks
• Regional banks under the Single Supervisory Mechanism (SSM)
• Specialized institutions
9
In our survey, we focused on two areas of interest:
• Trends and drivers that affect the Risk function, its leadership teams, and the required
competency profiles
• Assessments of the industry’s Risk functions’ maturity today, based on Oliver Wyman’s
Risk Leadership Competency Framework, and the industry’s ambition for the next five years.
Unlike skills, competencies do not refer to specific learned activities but to a broader ability
to perform the requirements of a role with proficiency. Oliver Wyman has developed maturity
ladders for all four competency areas. TRENDS AND DRIVERS AFFECTING THE RISK FUNCTION Our survey indicates that the future Joanne envisages is quite plausible, because there are
three trends that have the potential to transform the way Risk functions operate.
Trend 1: Cost and efficiency linked with technology and digitization
More than 90 per cent of survey participants have observed the pressure for more effective
and efficient risk management. Such pressure has led to an upward trend in the digitization of
the risk function (for example, artificial intelligence (AI), machine learning, and big data), with
companies recognizing that efficiency and effectiveness can be improved over the long term
by investing in technology.
One of the biggest challenges resulting from this digitization lies in developing, attracting, and
maintaining a digitally savvy talent pool. Participants in our survey reported stiff competition
for people with this kind of ability – competition from within the financial services industry and
from technology companies in other industries (such as start-up and mature tech companies).
RISK LEADERSHIP COMPETENCY BENCHMARKING SURVEY
“Steering the Risk function through digitization has become an existential question which will
completely change who we are and how we work. Today, we are not even close to capturing
what that means.”
CRO, Global universal bank
10
Exhibit 3: Survey results on priorities and resource allocation – objectives
WHICH ARE YOUR PRIORITY OBJECTIVES? TODAY IN 5 YEARS
Comply with regulation 7 8
Prevent losses due to business activities 5 5
Trusted advisor to the business 8 7
Attractive environment for top talent 5 7
Help the bank grow top-line 5 7
Source of constant innovation 5 7
Be as efficient as possible 5 5
Ranking: 1 – low to 10 – high; blue highlight refers to key step changes.
Exhibit 4: Survey results on priorities and resource allocation – resources
ON WHICH ACTIVITIES DO YOU SPEND MOST RESOURCES? TODAY IN 5 YEARS
Advisory services to senior management and business 6 7
Innovation development 3 7
Ad hoc analytics and stress testing 7 7
Risk identification and assessment process 5 6
Methodology and model development (incl. validation) 8 6
Risk framework and policy development (incl. risk appetite/limits) 6 5
Controls and Compliance 7 5
Function management/Change management 3 5
Interface management 4 4
Standard analyses/Report production (incl. regulatory reporting) 6 3
Ranking: 1 – low to 10 – high; blue highlight refers to key step changes.
11
Trend 2: Shift towards innovation
There was a coherent understanding among interview participants that Risk, which has not been
known for its innovation excellence, needs to up its game and start investing more and more in
this area. Some respondents went as far as saying that Risk should become the new innovation
hub within their bank, enabling front-to-back process innovation (linked, of course, to digitization).
Examples include innovative programmes and apps across the credit process, from idea to reality,
and innovative and new data handling that also supports other areas in the bank. For this to work,
there needs to be a major shift in tasks and competencies, enabling innovation to become
part of the DNA of the Risk function. This is a step change leading to a major adjustment in
the self-perception and vision of those who manage risk.
Trend 3: Levelling-off of regulatory demands
An overwhelming majority of the banks we surveyed expect that regulatory demands will level
off moving into a more steady state in a business as usual environment. Don’t mistake this for
regulatory pressure to seize – it is just an increasing efficiency with which regulatory demands
are served given the increasing stability of these. This could free up time and resources, especially
for the activities that CROs wish to focus on more extensively, like advising the business and
contributing to top-line growth or ad-hoc analyses. In other words, Risk functions are likely to
divert proportionally fewer resources on technical, methodological, and reporting activities
and instead focus more on services that add value for the business. This potential may raise
the question of whether the competency profile of the current Risk leadership is fit for the
future (Exhibit 3 and Exhibit 4).
“Efficiency is key. And efficiency can only be achieved through new technology – no doubt
about that. In order to cope with that, we need to disrupt our talent, our talent management,
and our recruiting. If we do not hire the right people today, we will have lost in five years’ time.”
CRO, European universal bank
12
Using the maturity ladders in our Risk Leadership Competency Framework, we assessed
the current state of play in Risk functions and the ambition or change that would be required
over the next five years. Broadly speaking, some core step changes will be needed across most
areas, and that means a fundamental disruption in the competencies of today’s Risk leaders.
New and unexpected changes will massively influence the abilities that risk executives are likely
to need in the future. As these competencies take time to develop, with input from different
types of individuals, businesses should start disrupting their Risk function now. And this means
redefining the function’s strategy and vision today so it can meet tomorrow’s requirements.
Below, we summarize some of these core changes in four areas: strategic competencies,
operational competencies, managing people, and influencing people (Exhibit 5).
Strategic competencies
All respondents agreed on the need for a broader shift towards strategy as a core ability
of Risk functions. This is supported by an increased focus on strategic thinking and digital
aptitude, being the core pillars of this competency. Equally, there was unanimous agreement
that traditionally important competencies, such as market insight, decline in importance as
they become increasingly commoditized.
Operational competencies
Interestingly, despite a step change in the strategic dimension, operational competencies
are expected to be broadly maintained at today’s levels, with a “more of the same” approach.
One exception is knowledge acquisition. Respondents rated this as an important ability
if they were to excel as risk managers or leaders. This is clearly the result of innovation and
digitization finding their way into the Risk function’s work, driving the need to develop new
skills and, therefore, extend knowledge.
Managing people
Talent management is one of the hidden and undervalued factors affecting future success.
Every interviewee in our survey described the upgrade required in that area as a major step
change for their respective organisation and absolutely vital in order to succeed. Historically,
Risk functions have been weak in placing enough emphasis on this competency. It was simply
not seen as a priority. With new disruptive market entrants and an increasing struggle to find
the right talent, along with unexpected competitors (as corporates and tech firms alike look
for similar skillsets), talent management becomes a cornerstone for the future success of
a Risk function. So it is essential for the Risk leadership team and the function as a whole to view
competencies in people management as a high priority.
Influencing people
Softer factors, such as culture and communication, which historically have not held a strong
position with the Risk function, will become more important. Why is that? Risk leaders are
convinced that the ability to influence will be at the heart of Risk functions. Influencing
behaviour (in the context not only of risk culture but also of top-level strategic decision-making)
will become a core competency. As this is regarded as a new field of expertise, and something that
most Risk functions lack, Risk leadership teams will have to make a step change in their abilities.
MATURITY ASSESSMENT: OLIVER WYMAN’S RISK LEADERSHIP COMPETENCY FRAMEWORK
13
Average industry (current)
Required in a disrupted future
12
34
5
Strategic thinking/big picture focus
Digital aptitute
Market insight
Change leadership
Managing people
Influencing
Strategic
Operational
Average industry (current)
Required in a disrupted future
12
34
5
Strategic thinking/big picture focus
Digital aptitute
Market insight
Change leadership
Managing people
Influencing
Strategic
Operational
12
34
5
Results focused
Change execution
Knowledge acquisition and creation
Analytical aptitude
Average industry (current)
Required in a disrupted future
12
34
5
Team management
Talent management
Positive example
Self awareness and willigness
to grow
Average industry (current)
Required in a disrupted future
12
34
5
Stakeholder management
Communication
Motivation
Culture
Average industry (current)
Required in a disrupted future
Exhibit 5: Results from our Risk leadership competency benchmarking survey
14
It is 2030 and disruption has taken place in the banking industry in Chris’ scenario, a little
later than it did in Joanne’s. As TradBank’s Risk function had not been equipped to respond
to disruption, a competitor acquired it. In particular, the bank’s Risk function had a rigid
operating model that was unable to keep up with industry developments, and its Risk
leadership did not have the right competencies to steer the transformation and lead the bank
through an ever-changing landscape.
Following the acquisition, Chris retired. His daily afternoon stroll takes him to the same café
where he met Joanne five years ago. Once inside, he cannot help but contemplate how his
Risk function might have been more successful if he had been persuaded by Joanne’s arguments.
With the benefit of hindsight, he would like to go back to 2017 and advise his Risk function
to embark on a transformation programme to prepare for an industry-wide disruption. He
would make four main suggestions.
1. Be ready for disruption and to invest in an agile and responsive Risk function to be able
to cope with a range of future states.
By definition it is not possible to pick a single planning scenario and, as a strategic partner
to the business, risk management teams should be fully engaged in the strategic and scenario
planning process, and master agile approaches to working to accelerate their speed-to-
change. This requires in particular the Risk Leadership team to lead by example and broaden
their own competencies to embrace this core challenge of the Risk function going forward.
2. Act on your desire to become more strategic. The role of the Risk function in setting
out a strategy can be broader than it currently is, and it can add more value.
To optimize risk-return, focus on the big picture.
Risk functions need to embrace a more strategic role and redefine their place when it comes
to strategic discussions and decision-making. The Risk team as a whole will be taken seriously,
and accepted as a peer at the strategy table, only if the Risk functions upgrade their strategic
competencies.
IF CHRIS KNEW THEN WHAT HE KNOWS NOW …
15
3. Strengthen communication, motivation, and other factors to sustainably influence
the organisation as a whole and drive culture, behaviour and conduct. These are the hidden
ingredients for success and yet they are unlikely to be in your Risk function’s DNA.
Today’s Risk functions pride themselves in their analytical excellence, very detailed and
comprehensive understanding of risks, and sustainable management of their institution’s
risk appetite. Behavioural and cultural factors are still massively underemphasized and
typically not seen as a priority by most of today’s Risk leadership teams. But you will succeed
in an increasingly connected world only if you are able to engage with the entire institution,
communicate effectively and constructively, and motivate all sorts of people within and
beyond your direct remit.
4. Invest in the next generation. Make tomorrow’s Risk talent and leaders your core
priority, don’t settle for more of the same; hire the not-so-obvious candidate who brings
new but necessary competencies.
Risk functions now have a clear mandate regarding talent management. Identify talented
people who have a rounded competency profile, an excellent grasp on technology, and the
ability to communicate effectively and influence others. Focus on candidates who have a
vision of the future and a passion to drive that vision. Lastly, leverage the strength of a diverse
workforce: Look for alternative sources for talent, from non-typical career paths and atypical
CVs. By attracting and retaining top talent, you will build a foundation for success – and the
most basic way to achieve this is to create career paths that appeal to high achievers.
How to achieve these major step changes across your Risk function as a whole and your
Risk Leadership team in particular will heavily depend on the individual institution’s starting
point which varies significantly. One observation is shared across our interviewees: Only if you
embark on the journey of change today, you will be ready in time to react to whatever state
of the future pans out in reality.
16
Narrow strategic thinking.
Moderate ability to identify change initiatives.
STRATEGIC
COMPETENCIES
Moderate track record of strategic thinking.
Limited ability to leverage market insights/ regulatory developments.
Good ability to execute change initiatives.
Understands and synthesizes data into strategic/big-picture conclusions.
General understanding of the power of digitization.
Moderate ability to leverage market insights/ regulatory developments.
Challenges status quo and can identify areas where change is needed.
Proven ability to weigh up a number of key factors in driving strategic decision- making.
Risk function can benefit from digitization but requires assistance to identify how to effect a digital transformation.
Good ability to leverage market insights/ regulatory developments.
Challenges status quo, identifies areas where change is needed and defines target state.
Future thinker and visionary, influencing strategy development at executive committee level.
Digitally savvy with good understanding of how technology can help innovate and improve the risk profile of the bank in general and the Risk function in particular.
Thought leadership leveraging a strong awareness of external market and regulatory developments.
Identifies and drives change through different and innovative approaches in order to react to evolving situations.
Able to drive results forward.
Some ability to execute change.
Fairly results focused, often using traditional methods to deliver Able to execute change.
Captures new knowledge to keep up to date.
Results focused and using innovative processes to deliver results.
Effective at managing change, actively works to remove barriers.
Captures new knowledge and actively shares with team.
Analytical aptitude used in interpreting work from team.
Results focused – collaborates with others across business to drive outcomes, using innovative processes.
Effective at managing change, removing barriers, and leverages cross- organizational support.
Committed to training team, front runner in capturing up-to-date knowledge.
Analytical aptitude used in decision-making, the go-to person for analytical thinking.
Highly result focused – ability to build an environment to achieve results in line with right values, collaborates across business.
Highly effective at managing change, reputation for being a mediator and as someone who gets things done.
Actively extracts new knowledge, trains risk team and contributes to risk method innovation.
High analytical aptitude, guides the design of difficult pieces of analysis for the team and clearly explains rationale for decision to others.
OPERATIONAL
COMPETENCIES
OLIVER WYMAN’S RISK LEADERSHIP COMPETENCY FRAMEWORK
LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5
LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5
17
Moderately effective at team management and communication.
Awareness of own management style.
Effective at team management and clear communicator.
Is open to ambition of team members to grow towards next level roles.
Awareness of how own management style affects team.
Communicates with high impact, expert team manager.
Contributes to talent management and encourages team members to develop.
Actively contributes to positive team environment.
Open to feedback on management style and encouraging work-life balance of team.
Proven ability to manage teams effectively and set goals, even during crunch times.
Takes time to actively support talent management and creates opportunities.
Contributes to positive team environment and exemplifies values to the team.
Actively seeks out feedback on management style and very encouraging of growth from self and others.
Highly effective at team management with a strong executive presence whilst having the ability to clearly communicate and set goals.
Actively builds the next generation of talent and dedicates time to develop, support, and create opportunities for staff, has also developed a talent management strategy.
Exemplifies team values and management, creates environment of trust .
Has a dynamic management style, understands team dynamics, and is very approachable on sensitive issues.
MANAGING
PEOPLE
Understands stakeholders in wider context.
Moderately clear communicator.
Able to obtain buy-in from stakeholders on most recommendations, understands wider context.
Generally a clear communicator.
Some appreciation of team’s personal/life well-being.
Obtains stakeholder buy-in even on difficult/controversial recommendations, trusted by executive Board.
Clear communication around expectation and goals.
Adopts a motivational style that encourages collaboration and builds a sense of connection.
Proactive on personal life and well-being issues.
Creates a strong network with senior stakeholders in the organisation.
Excellent communicator, including on sensitive issues.
Takes care to mentor, coach, or sponsor people in their firm, highly motivational.
Understands and modulates effect of own style on colleagues, actively builds towards a culture of accountability while paying attention to personal life issues.
Demonstrates seasoned diplomacy skills with stakeholders and resolves conflicts with high degree of professionalism.
Communicates with high impact and effectively uses influencing skills to achieve results.
Ability to energize and motivate peers within and outside the organization, boosting their drive to reach an end goal, encourages collaboration and builds a sense of connection.
Sets the tone and leads by example in building a culture of accountability, with high moral standards while paying attention to personal life issues.INFLUENCING
LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5
LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5
18
AUTHORS
CLAUDIA FELL
Partner in Oliver Wyman’s Finance & Risk and Organizational Effectiveness practice
based in our Dusseldorf office
DOMINIK WEH
Partner in Oliver Wyman’s Finance & Risk and Public Policy practice
based in our Frankfurt office
PETROS ANDREOU
Manager in Oliver Wyman’s Finance & Risk and Organisational Effectiveness practice
based in our London office
19
Copyright © 2017 Oliver Wyman. All rights reserved.
Oliver Wyman is a global leader in management consulting that combines
deep industry knowledge with specialized expertise in strategy,
operations, risk management, and organization transformation.
www.oliverwyman.com
ABOUT OLIVER WYMAN
AMERICAS
+1 212 541 8100
EMEA
+44 20 7333 8333
ASIA PACIFIC
+65 6510 9700