Risk Benchmarking
Welcome to Risk Benchmarking, a new research service scrutinising op risk practices at a range of financial institutions. Each quarter, we’ll share some of the findings from one of four cohorts – G-Sibs, other banks, asset managers and insurers, and FMIs.
Participants get to see all the data – message us for details: benchmarking@risk.net
CROs shoulder climate risk load, but bigger org picture is murky
Dedicated teams vary wildly in size, while ownership is shared among risk, sustainability and the business
‘The models are not bloody wrong’: a storm in climate risk
Risk.net’s latest benchmarking exercise shows banks confronting decades-long exposures, while grappling with political headwinds, limited resources and data gaps
Climate Risk Benchmarking: explore the data
View interactive charts from Risk.net’s 43-bank study, covering climate governance, physical and transition risks, stress-testing, technology, and regulation
Many banks see obstacles to options-based IRRBB hedging
Liquidity, accounting treatment and culture seen as impediments to wider use of swaptions, caps and floors
ALM has no formal role in capital planning at a third of banks
Risk Benchmarking study finds banks split three ways on policy mandates, with G-Sibs as likely as small regionals to assign ALM formal responsibility
Explore the data
Climate unsettled
“Banks are still struggling with the climate risk operating model: talk to 20 banks and you’ll get 20 answers.”
Risk.net’s Climate Benchmarking study suggests that may be only a slight exaggeration. While most banks place oversight of climate risk with the CRO, consensus on organisational models largely ends there. Firms are split between centralised climate teams; joint ownership between risk and a dedicated sustainability or ESG function; and those with responsibilities spread across functions.
Enterprise risk
Fewer than half of banks rate their GRC vendor as ‘good’
Enterprise Risk Benchmarking study shows banks juggling multiple systems, adding costs and complexity
Most banks add ERM heads – but CROs keep control
Hiring tilts towards AI, cyber and model risk as enterprise risk’s remit grows faster than its reach
71% of banks automate escalation of appetite breaches
Automated processes are less common at banks where ERM sets overall risk appetite, research shows
North American banks outpace Europeans in ERM
New research shows US, Canadian banks have more developed enterprise risk management functions
Operational risk
Banks curb frequency of GRC vendor reviews
Data shows drop in plans to pitch or switch vendors, amid tighter third-party rules – but TPRM bucks the trend
In more than 90% of banks, second line tackles cyber risk
But some regulators would still like to see more 2 LoD risk staffing for infosec and IT disruption
Almost all banks mandate cyber security training
And unlike other risks, information security coaching moves the internal confidence dial
Regional banks favour scenario analysis over op risk modelling
Domestic and smaller regional players favour scenarios to gauge tail exposure; G-Sibs stick to modelling, for now
Top 10 Op risks
Top 10 op risks: AI arms race leaves risk teams playing catch-up
As firms invest for fear of being left behind, op risk managers urge caution on data, controls and access
Top 10 op risks: Why cyber risk looms larger than its losses
Fast-moving threat landscape and increased supplier concentration keep infosec top of the table
Top 10 op risks: For change management, the cloud is its own weather front
As lenders move legacy banking to the cloud, the risks of getting it wrong are exponentially greater
Top 10 operational risks for 2025
The biggest op risks as chosen by senior practitioners – and what they’re doing about them
XVAs
Squashing CVA still dominates XVA desks’ priorities
Dealers favour options-based strategies to manage charges; some explore contingent CDSs amid rising exposures
XVA desks prioritise core tech upgrades over AI
Vendor upgrades, cloud-native rebuilds and sensitivities tooling dominate 2026 budget road maps
XVA desks target capital in optimisation runs
US regulatory uncertainty leaves banks cautious on investing in new optimisation tools, Risk Benchmarking study finds
Almost two-thirds of banks now run XVAs on cloud
Risk Benchmarking study finds a majority of big dealers tapping cloud capacity, some exclusively, with others migrating
ALM
Many banks see obstacles to options-based IRRBB hedging
Liquidity, accounting treatment and culture seen as impediments to wider use of swaptions, caps and floors
ALM has no formal role in capital planning at a third of banks
Risk Benchmarking study finds banks split three ways on policy mandates, with G-Sibs as likely as small regionals to assign ALM formal responsibility
Banks hold 73% of liquidity buffer in cash and Level 1 assets, on average
Largest lenders hold highest share of central bank reserves in buffer, latest analysis shows
EVE and NII dominate IRRBB limit-setting
ALM Benchmarking study finds majority of banks relying on hard risk limits, and a minority supplementing with early-warning indicators
