- Risk
The 2027 ProSight Risk Outlook Survey: New Opportunity, New Tools for Reinvention
,
Share
This report is based on the 2027 ProSight Risk Outlook Survey, which was conducted online in August and September 2026, and prepared in collaboration with Oliver Wyman, a Marsh business. Find out more about the survey, including the demographic profile of respondents, here.
Signals of regulatory flexibility and rapid advances in AI are converging to change both the risks banks face and how risk functions operate. A perceived shift toward less-prescriptive regulatory supervision coincides with fast-moving developments in AI, giving institutions greater flexibility in how risk work is performed even as technology, cybersecurity, fraud, and data risks become more complex and interconnected. The 2027 ProSight Risk Outlook Survey, conducted in collaboration with Oliver Wyman, a Marsh business, finds banks simplifying processes in the near term while pursuing broader, AI-enabled transformation.
Taken together, the findings depict a risk function evolving toward greater agility, automation, and responsiveness, with AI, changing supervisory expectations, and increasingly interconnected risks shaping that transition.
New Opportunity, New Tools for Reinvention
Institutions are rethinking risk management operations as regulatory scrutiny becomes generally less prescriptive and more focused on factors most consequential to financial safety and soundness. With dynamic technologies in hand and upgrades to risk practices in mind, banks and credit unions are beginning to retool for greater agility, simplicity, and concrete outcomes, with an eye toward long-term transformation and improved visibility into an increasingly complex and interconnected risk landscape.
In ProSight’s 2027 Risk Outlook Survey, conducted in collaboration with Oliver Wyman, a Marsh business, risk leaders and other respondents said their areas of greatest concern remain similar this year: technology and cyber, fraud and financial crimes, and data privacy remain today’s top categories of risk. (See Figure 1) But through continued investment and smart use of artificial intelligence, their institutions hope to transform risk programs in these most sensitive areas, while raising service standards in operational risk/resilience and credit risk, among others.
Figure 1. Technology and cyber risks draw focus
AI, meanwhile, ranks high across banks’ risk agenda, as a potent cybercrime tool, an agent for driving operational change, and a focal point for regulators. Increasingly, banks are tasking the risk function with assessing the exposures these various applications of AI create for the enterprise as the technology rapidly—and at times startlingly—evolves.
As transformation within the risk function gets underway, respondents see opportunity for risk professionals to step more deeply into business strategy, using optimization not simply to reduce costs, but to shift their time away from repetitive processing and review work toward higher-value activities that improve decisions, responsiveness, and the quality of risk management.
Responses to this year’s survey show how a changing regulatory tenor and rapid adoption of AI are opening a window to reshape the risk function. With a majority (78%) agreeing that regulatory requirements have become less prescriptive about risk processes, they perceive latitude from a regulatory standpoint to rethink operational and resource priorities. Banks are responding by investing in areas of greatest risk, pursuing short-term change programs and longer-term transformation to sharpen risk management, improving the speed and quality of decision-making, and positioning risk as an indispensable collaborator in defining and guiding business strategy.
Supervisory Signals Lead to Opportunity for Transformation
A perceived shift in supervisory priorities, from adhering to prescribed procedures to delivering outcomes, is giving banks greater latitude to rethink how risk work gets done. Institutions are exploring ways to remove layers of redundant process, refocus compliance and reporting activities, and streamline operations overall. Eighty-seven percent of respondents agreed that changes in the operating environment present opportunities to optimize risk processes at their institutions.
Banks are enhancing their risk programs primarily to better respond to risk events and improve the quality of risk management. As risks to the industry intensify and intertwine, and the pace of change in the threat landscape accelerates, institutions are simplifying and prioritizing for agility, transparency, and increased certainty to act. (See Figure 2)
Figure 2. Optimization efforts seek faster, more decisive response to risk events
“The most underestimated risk is the increasing interconnectedness of risks across the financial system,” said one senior risk leader at a midsized bank regulated by the Fed. “Economic, technological, consumer, fraud, cyber, and regulatory risks are becoming more tightly linked, creating the potential for small changes to produce disproportionate outcomes. The challenge is less about predicting individual events and more about recognizing [and adapting quickly] when established assumptions are no longer valid.”
Cost savings remain important, but they ranked third (58% choosing “Very Important”) in the survey. Large banks were notably more likely than their smaller peers to cite cost savings as a motivation for optimizing.
In practical terms, 67% of respondents said they are optimizing risk programs by changing how they work, including introducing AI and automation into work processes. Almost half (46%) are eliminating duplicative reviews, including “checking the checker” activities.
So far, the perceived regulatory pullback has been most evident in reputational risk, cited by 44% of respondents. Still, banks maintain a high level of vigilance in areas such as operational resilience and fraud, where noteworthy failures undermine customer and investor trust. As a respondent from a midsized bank said, “negative publicity from operational failure and loss of customer and investor confidence” are among the most consequential yet underestimated risks to the industry.
AI adds another dimension to reputational risk. Agentic and generative AI model risk (41%) was the second-most selected emerging risk in the survey. Managing it, said Russell Zusi, senior executive vice president and chief risk officer at Regions Bank, involves maintaining a robust institutional framework and for his institution, at least for now, ensuring humans are in the AI production chain.
“I’m a firm believer that if you have the right structure and programmatic approach in how we govern and manage risk internally, you should be able to take any emerging risk and feed it into an infrastructure…[that is] mature and malleable enough to handle it,” he explained. That said, “we’re just not at the point yet where we feel like it’s the right step for us” to allow AI to run unmonitored.
AI at the Nexus of Risk and Renewal
AI looms large in the survey in two distinct ways: as a source of expanding risk especially in fraud and cybercrime and as a powerful tool for operational transformation across the risk organization.
AI has quickly emerged as an effective, scalable weapon for bad actors. Dozens of respondents cited AI-fueled cybercrime as the most consequential yet underestimated risk facing financial services, even as a majority named cybersecurity among their top concerns.
It is also among the leading emerging concerns for the coming years. Forty-eight percent identified technology and cyber risk as a top emerging risk, compared with 33% for fraud and 27% for data privacy or data risk, all of which also rank among today’s leading risks. (See Figure 3)
Figure 3. Technology, AI, and data risks are most common emerging risks*
Banks are responding with increased investment. Forty-three percent raised their cyber and technology risk budgets in the past year, while 35% increased spending on operational risk, another area heavily influenced by technology. That investment is expected to continue: 53% anticipate their annual cyber and technology risk budgets growing by at least 5% a year for the next three years.
“We invest a good deal of money into buying top-of-the-line AI infrastructure and modeling toward risk and fraud prevention,” said one risk leader at a community bank whose institution was among those eyeing annual budget increases of at least 5%.
Development of AI controls and guardrails appears to be advancing more slowly than AI adoption. At least half of respondents described elements of their AI frameworks, including risk appetite, governance, and controls, as only somewhat developed, with similar assessments of AI infrastructure. Technology itself remains a primary obstacle to broader adoption for 31% of respondents.
The tension between the pace of adoption and the need for mature controls is particularly striking because AI is creating new responsibilities for the same risk functions seeking to harness it. AI practices are also the area where respondents expect regulatory pressure to increase during the next 12 months, named by 65%, compared to 48% who cited technology and cybersecurity risk. Risk functions are therefore being asked to establish enterprise frameworks and controls for AI even as they deploy the technology within their own operations.
“We’re tested to stay in front of this new technology as opposed to getting behind or allowing our customers to be more advanced than we are,” said one banker at a midsized institution.
The ability to measure the value of investments has not kept pace with adoption, survey responses show. Only 16% use a formal return-on-investment analysis, while 41% assess returns informally and 43% do not measure them at all. When measurement does occur, approaches vary widely, from capturing the volume and quality of alerts generated by fraud-monitoring programs to logging perceived productivity gains or reductions in headcount.
Transforming Key Risk Programs
Banks are moving beyond incremental efficiency improvements toward a more fundamental transformation in risk management. That shift is most apparent in the areas where banks see both significant risk and significant opportunity for change. Cybersecurity and technology stand out, with 47% of respondents identifying them as offering the greatest opportunity for risk-program transformation over the next two to three years. Operational and resilience-related risk follows at 41%, while compliance/financial crime is close behind at 40%. The overlap is notable. These are technology-related or technology-enabled risks; they are also among the issues of greatest concern to financial institutions.
Overall, 64% of respondents said their institutions are using AI within risk, and another 26% are conducting pilots or proofs of concept. Survey responses describe a spectrum of applications, from productivity improvements using Copilot and similar tools to credit due diligence, onboarding, analysis, and operational workflows and controls. The applications span both quantitative and qualitative work.
“We use AI to reduce manual effort and time spent on risk assessments and to improve the quality and speed of risk management decisions,” said a risk leader at one regional bank.
Banks are simplifying fragmented processes, automating repeatable activities, and reducing manual effort, changes that can improve visibility and responsiveness while creating a stronger foundation for more extensive use of AI. In technology and cyber risk, that evolution points toward more proactive, AI-enabled approaches to detecting, assessing, and responding to increasingly sophisticated threats.
Credit presents a different but related case. Though institutions do not currently rank it among their most urgent or emerging threats, it remains a focal point of optimization. Rather than waiting for the credit environment to worsen, institutions appear to be using the current period to strengthen their capabilities. Thirty-five percent increased credit risk budgets by at least 5% in 2026, 29% see credit risk programs as a primary target for optimization in the coming year, and 36% will increase their budgets for it by 5% or more over the next three years.
That investment illustrates how near-term optimization can prepare banks for broader transformation. One risk management leader at a bank with more than $1 trillion in assets described a multiyear effort to address legacy issues in credit risk by improving data quality and lineage, mapping “golden sources,” and strengthening reporting.
Once that groundwork was in place, the focus shifted to continued reinvention. “Once we got over those initial hurdles, the question became ‘How do we continue to stay current and sustainable and use the tools at our disposal?’” the risk leader said, including deploying AI to enhance credit-risk controls.
The survey findings suggest other institutions are contemplating a similar progression. Thirty-nine percent of respondents believe AI can drive credit-risk transformation within the next two to three years. That could include streamlining underwriting and credit assessment through technology-enabled workflows while enabling more continuous and proactive monitoring of credit portfolios. In that sense, investment in credit risk is not simply a response to concerns about potential deterioration. It is also an opportunity to modernize the function before the next turn in the credit cycle.
Across technology and cyber risk, operational risk and resilience, and credit risk, a common pattern emerges: simplifying and strengthening today so that AI can enable more fundamental change tomorrow. Banks are addressing fragmented processes, manual activities, data limitations, and other foundational weaknesses while beginning to rethink how those activities could ultimately operate in a more automated and proactive environment. The significant overlap between the areas targeted for near-term optimization and those identified for future AI-enabled transformation suggests these efforts are not separate initiatives.
What’s holding them back? Data. Forty-nine percent name data quality and availability deficiencies among their top three obstacles to AI deployment, the most frequently selected barrier. Other obstacles include technology and workforce knowledge, cited by 31%; controls, 26%; and management bandwidth, 21%. (See Figure 4)
Figure 4. Low-quality data, lack of expertise, and IT infrastructure limit the use of AI in risk management
The challenge is foundational because the usefulness of AI depends heavily on the information available to it. Those limitations become particularly important in information-intensive processes such as loan origination and monitoring. Free-text responses to the survey reinforce this concern, with multiple executives identifying data, or the lack of it, as one of the most consequential yet underestimated risks facing financial services.
The issue is also shaping how banks prioritize transformation. Tom MacDonald, executive vice president and chief credit officer at $3 billion Maine Community Bank, described the need to concentrate resources on initiatives likely to produce meaningful results while building greater transparency into credit risk. “We have to be pragmatic that we’re not wasting time, energy, or resources on things that aren’t going to bear fruit for us,” he said. “If you’re talking about the world today, my biggest risk and my biggest concern would be data quality.”
Closing Thoughts
Taken together, the ProSight 2027 Risk Outlook Survey results capture the pressures and priorities for a risk function in a period of increased opportunity and expectation. Changes in supervisory tenor are creating greater latitude to reconsider how risk work is performed, while cyber threats, fraud, data shortcomings, and the growing interconnectedness of risks increase the need for speed, visibility, and more decisive responses.
AI represents both the peril and the possibilities of technology. It is expanding the threat landscape and creating new governance and regulatory responsibilities, while also supporting changes in risk assessment, monitoring, analysis, and controls. Yet the development of data foundations, infrastructure, and AI frameworks has not kept pace with adoption, leaving institutions at different stages of realizing AI’s value.
That same pattern extends across technology and cyber risk, operational resilience, and credit. Near-term efforts to simplify processes, reduce manual activity, and strengthen data are increasingly connected to broader changes in how those programs operate. What financial institutions hope will emerge is an evolving risk model shaped not simply by efficiency, but by the growing importance of anticipation, adaptability, and risk-informed business decision-making.
In August and September 2026, ProSight surveyed chief risk officers and other leaders at financial institutions primarily in the United States and Canada for its annual Risk Outlook Survey. This year’s survey was prepared in collaboration with Oliver Wyman, a Marsh business.
The Risk Outlook Survey explores the top trends in bank risk management, the most urgent priorities of risk leaders, and plans institutions are pursuing to transform risk management. For this year’s report, we received 160 survey responses and conducted post-survey interviews with select respondents. The respondent base reflects senior perspectives across a broad range of institutions.
% Respondents by Asset Size, USD
% Respondents by Primary Regulator
% Respondents by Role
Become a member to unlock exclusive content, connect with industry experts, and gain access to valuable resources. If your employer is an institutional member, activate your ProSight membership benefits with a simple email address.