Accueil
/ Publications
/ Articles
/ Is Your Risk Framework Capable, or Just Compliant?

Is Your Risk Framework Capable, or Just Compliant?

Why Boards and CROs Need Frameworks That Identify Emerging Risk Early Enough for Action

A financial services organisation can have a comprehensive risk taxonomy, a board-approved appetite statement, a populated control library and a clean framework review, yet still miss the risk that matters. That gap is now a practical concern across the financial services sector: a framework can be compliant without being capable. Framework reviews have helped demonstrate that governance, accountability, appetite, controls and assurance exist. The harder question is whether they show that the organisation can spot a material risk early enough to act.

A framework is only as valuable as its performance under pressure, not simply its documentation. Technology is reshaping operating models, distribution channels, customer and member interactions, underwriting, claims, advice and investment processes. The CRO role now extends well beyond traditional financial and operational risk. For boards and executives, the central question is whether the framework helps the organisation spot emerging risks early and act before they escalate. The gap rarely stems from a missing policy. More often, it emerges when a risk falls outside the existing taxonomy, or when warning signals dispersed across business lines, functions and owners are not connected quickly enough for action. An organisation can pass its periodic review and receive an adequate rating from an independent assessor or internal audit function, while still lacking a practical mechanism for detecting the risk it did not think to name.

That distinction matters to boards, CROs and accountable executives. A framework should do more than pass review; it should help detect risks the organisation has not yet identified. Most experienced directors and executives recognise this gap, but fewer can point to a framework review designed to test it.

Two-column table with five rows comparing compliance evidence statements against matching risk insight statements.

From Documented Resilience to Tested Capability

Risk management frameworks in Australian financial services have long assumed that a well-designed framework should help an organisation withstand disruption, protect customers and members and continue critical services through stress. Operational resilience was not treated as a separate discipline, but as effective risk management in practice. The introduction of APRA’s CPS 230 formalised and made testable expectations that had previously been implicit.¹

CPS 230 requires APRA-regulated entities to manage operational risks, maintain critical operations within tolerance levels through severe disruption and manage service-provider risks through formal agreements, monitoring and remediation. As a result, the focus for organisations has shifted from documenting resilience to demonstrating it under stress.

The requirement to prove resilience in practice challenges the effectiveness of traditional framework reviews, which often focus on the adequacy of documented arrangements rather than an organisation’s ability to operate through disruption. In financial services organisations, the real exposure often emerges between risk categories. A technology dependency can become a customer harm issue, a third-party failure can become a resilience event, an advice or claims process can become a conduct risk, and a data issue can become a prudential and reputational concern at the same time.

Why Integrated Risk Insight Is Becoming the Real Test

A traditional framework review is a point-in-time exercise against a largely static reference set. It asks whether policies exist, owners are assigned, risks are recorded, reporting occurs and controls have been tested. That remains necessary, but it is backward-looking: it can only test the framework against risks already known well enough to be named, allocated and checked.

That methodology is becoming less reliable for three connected reasons.

First, risks are changing faster than the periodic review cycle. Across the financial services sector, material risks increasingly sit at the intersection of digital channels, scams, cyber, third-party dependency, conduct, data and service delivery. A taxonomy built two or three years ago may still be technically valid, but it is unlikely to capture how those risks have changed in nature, scale or speed.

Second, resilience has made clear that risk categories were never as separate as the old operating model assumed. A disruption to a critical operation may be operational, third-party, technology, conduct and financial in nature at the same time. If those views remain separated across owners, reporting lines and committee cycles, the organisation may have complete risk reports and still lack a joined-up view for the executive team or the board.

Consider a material outage at a third-party technology provider supporting a critical business service. What first appears to be a supplier issue can quickly become a customer or member service failure, a conduct issue, a financial exposure, a prudential concern and a board matter. The framework is tested by how quickly those perspectives are connected and escalated, not by how neatly the event can be allocated to a single risk category.

Third, periodic reviews can reward the appearance of maturity rather than the substance of it. Sustained regulatory scrutiny has driven organisations towards increasingly elaborate risk frameworks comprising sets of policies, control libraries and governance structures. Those artefacts are necessary across financial services, but they are not sufficient. The more important question is whether the organisation would detect, escalate and respond to a risk before it became a loss event, customer or member harm, a failed service or a regulatory finding.

That concern is consistent with ASIC’s public focus on cyber resilience, scams and misconduct intelligence. ASIC describes cyber resilience as important to consumer and investor trust and confidence, market integrity and the resilience of Australia’s financial system. Its misconduct reporting and scams material reinforces the broader point that harm may emerge through patterns, trends and systemic issues not always visible through static registers or periodic reporting alone.²

What Decision-Useful Risk Insight Requires

If the old test was whether the framework was documented, the new test is whether it helps the right people see emerging risk clearly and early: the board, executive team, CRO and accountable business owners.

Identifying emerging risks earlier. A capable framework needs a practical way to spot and escalate risks that were not anticipated when the taxonomy was last updated. For regulated financial organisations, this means creating a disciplined process for elevating weak signals before they become customer harm, member impact, operational disruption or regulatory scrutiny.

Joining up risk information. Operational, resilience, conduct, technology, third-party, financial crime, prudential and financial risks cannot operate as separate tracks that only occasionally connect. The issues that matter most to the board rarely stay in one lane. A capable framework treats a material disruption, control breakdown or emerging risk as one connected issue, so management and the board can see it clearly.

Monitoring risks closer to real time. Manual, periodic control testing remains part of good governance, but it cannot be the only line of sight. Financial services organisations depend on complex platforms, data flows, outsourced providers and automated decisions. In our experience organisations are moving towards automated controls monitoring, continuous assurance and risk analytics so emerging issues can be seen and acted on sooner.

Escalating issues sooner. Quarterly committees remain important for oversight, but they are not always sufficient when a risk is moving quickly across customer, member, operational, prudential and conduct dimensions. An effective framework includes escalation pathways that can operate outside the standard cadence when needed, with clear accountability for who decides, who acts and who informs the board.

Risk culture that supports early challenge. Frameworks also depend on how people behave under pressure. An escalation pathway has limited value if people do not feel able to raise concerns early, challenge assumptions or admit that a control is not working as intended. Risk culture is therefore part of the operating test: when issues emerge, do people use the framework early enough to prevent them from becoming larger problems?³

AI governance as the current test case. AI is one of the clearest current examples of the capability gap. Across financial services organisations, it may influence credit, fraud, underwriting, pricing, claims, complaints, personalisation, advice support, member servicing and administration. A framework that has an AI governance policy but no operating mechanism for assessing model behaviour, monitoring for drift, identifying third- and fourth-party dependencies, managing supplier concentration or escalating AI-related control failures is exposing the gap between policy and practice in real time.

In most cases, the issue is not a genuinely new category of risk. Familiar risks such as model risk, conduct risk, operational risk, cyber risk and third-party risk become harder to identify in time because underlying systems learn, evolve and influence decisions faster than traditional review cycles can track. APRA’s 2026 industry letter on AI makes the same point in prudential terms: governance, risk management, assurance and operational resilience practices were not keeping pace with AI adoption; boards needed sufficient AI literacy to provide effective challenge; and monitoring and reporting should cover third-party dependencies with clearly defined triggers aligned to resilience objectives.⁴ FTI Consulting’s AI Risk Management Playbook makes a similar leadership point: AI risk needs clear ownership, governance, oversight and monitoring, rather than being left to technology teams alone.⁵

The common thread is the ability to bring scattered risk signals together in time for management to act.

A Practical Test for Risk Insight

A review focused on operating capability should test whether the framework helps the organisation deal with a realistic risk scenario that cuts across teams, systems and service providers. A framework can look strong when reviewed part by part, yet fail when an issue crosses business lines, functions, suppliers and committees.

One practical starting point is to trace the path from signal to decision. What would the organisation see first? Who would see it? How would separate indicators be connected? When would the issue move outside routine reporting? What evidence would show that the framework changed the outcome before harm, disruption or regulatory scrutiny occurred?

Table showing a five-step pathway of signal, connection, escalation, decision and assurance, each with a question.

The point is not to add another checklist, but to test whether the organisation can move from early warning signs to accountable action before harm, disruption or regulatory scrutiny occurs.

The same test should also ask whether people are likely to raise the signal early. If the culture discourages challenge, delays bad news or treats escalation as failure, the framework may not work even if the process is well designed.

Applied to a current risk area such as AI, a third-party technology dependency or scams response, this approach helps test whether the framework works in practice or only looks complete on paper. It also gives boards and CROs a clearer basis for challenging management: not “Do we have a policy?” but “Show us how this risk would be spotted, joined up, escalated and acted on before it causes harm or disruption.”

The Decision for Boards and CROs

In board and executive discussions, framework reviews often reduce to a familiar question: are we compliant? It is the question the periodic review was built to answer, and it produces an orderly report. But it is no longer enough.

The harder question for directors, CROs and accountable executives is whether the framework would have detected a material risk before it became a regulatory finding, failed service, customer or member harm issue or material loss. The most important risk may not be the one already on the register. It may be the issue that emerges between owners, functions and reporting cycles. Would the organisation have seen it early enough to act, or would it have discovered the gap only through remediation, assurance findings or regulatory challenge?

The purpose of risk management is not to maintain the longest possible catalogue of known risks. It is to help leaders identify, assess and respond when risk moves beyond what the organisation expected. The next framework review should therefore test it in practice, not only confirm that the artefacts are in place. By turning fragmented signals into actionable insight, an effective framework gives boards and executive teams the visibility needed to act earlier and shape the outcome rather than react to it.

Footnotes:

1: Australian Prudential Regulation Authority (APRA), “CPS 230 Operational Risk Management” (1 July 2026).

2: Austl. Sec. & Invs. Comm’n, “Cyber resilience,”; Austl. Sec. & Invs. Comm’n, “ASIC cyber resilience resources,”; Austl. Sec. & Invs. Comm’n, “Reports of misconduct data,”; Austl. Sec. & Invs. Comm’n, “Scams,”.

3: Mark Gossington, Simon Taylor-Allan, Swati Swarup, “Risk Culture: From Compliance to Strategic Advantage,” FTI Consulting (11 December 2025).

4: Australian Prudential Regulation Authority (APRA), “APRA Letter to Industry on Artificial Intelligence (AI)” (30 April 2026).

5: Jerome Nyssen, Warren Dunn, “Risk Management in the AI Era: A Playbook for Leaders,” FTI Consulting (9 September 2026).