Build, or buy: banks still don’t love their GRC vendors
Risk Benchmarking study finds a record number of firms reviewing tech provision for top op risks, amid touted wave of AI-led self-builds
This piece is part of a series benchmarking bank operational risk management practices. Risk Management subscribers can view selected cuts of the underlying data here. Sign up for Risk Benchmarking emails here.
A majority of bank rate their primary operational risk technology vendors as ‘adequate’ – a grade that masks a wide disparity in the state of provision for managing both mature and emerging
Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.
To access these options, along with all other subscription benefits, please contact info@risk.net or view our subscription options here: http://subscriptions.risk.net/subscribe
You are currently unable to print this content. Please contact info@risk.net to find out more.
You are currently unable to copy this content. Please contact info@risk.net to find out more.
Copyright Infopro Digital Limited. All rights reserved.
As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (point 2.4), printing is limited to a single copy.
If you would like to purchase additional rights please email info@risk.net
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (clause 2.4), an Authorised User may only make one copy of the materials for their own personal use. You must also comply with the restrictions in clause 2.5.
If you would like to purchase additional rights please email info@risk.net
More on Operational risk
Banks insure against cyber risk, but rarely claim
Risk Benchmarking study finds big banks aggressively negotiating on cost of cover, and seeking offsets to Pillar 2 capital
Four in five banks use AI to manage op risks
Risk Benchmarking: Cyber risk use cases growing; governance and ROI doubts give some pause
AI use fastest-growing area of op risk regulatory scrutiny
Risk Benchmarking study finds EU AI Act the dominant driver of nascent bank risk frameworks, even well beyond Europe’s borders
On cyber risk, tech debt is big banks’ top challenge
Risk Benchmarking: Fragmented stacks make identifying vulnerabilities harder; manual workarounds increase human errors
Half of banks use scenarios to set third-party Pillar 2 capital
Risk Benchmarking study finds resilience risk less widely covered than cyber and IT disruption, but more formalised where scenarios exist
Second line seeks to stamp its authority on AI risk
Risk Benchmarking study finds fragmented accountability for AI risk among banks, and most are short of controls to contain it
Op Risk Benchmarking 2026: explore the data
View interactive charts from Risk.net’s 61-bank study, covering risk appetite breaches, controls, scenario analysis, GRC tech and regulation
Appetite breaches climb for top op risks
Risk Benchmarking: Low tolerance and heightened threat environment combine to test banks’ limits for cyber, resilience, third-party risk
