By Julien Haye, Founder and Managing Director, Aevitium LTD
Risk and compliance functions have expanded considerably in response to regulatory expectations, emerging technologies, operational resilience requirements and increasingly complex financial crime, cybersecurity and third-party risks.
Much of this expansion is necessary. Yet financial institutions can continue investing in specialist expertise, controls and technology while experiencing persistent capacity pressures, duplicated activity and increasingly complicated decision-making.
This brings the relationship between capacity and workload into focus: does the problem lie solely in the resources available to manage risk, or also in the amount of work the organisation generates through its approach to managing it?
This distinction brings an often-overlooked dimension of risk operating model design into focus: Risk Demand.
The risk management workload extends well beyond the Risk function
When financial institutions review their risk operating models, the discussion frequently begins with organisational structure and headcount.
How large should the Second Line be? Which responsibilities should sit with the business? Should specialist capabilities be centralised or embedded? Could automation reduce the administrative burden?
These are legitimate questions, but they primarily examine the supply of risk management capacity. They do not necessarily explain what generates the workload.
Risk management activity extends across the organisation. Business teams operate controls, complete assessments, investigate exceptions and maintain evidence. Compliance and specialist risk functions establish requirements, monitor exposures and provide challenge. Management participates in governance forums, reviews reporting and oversees remediation. Internal Audit provides independent assurance.
The combined organisational effort required to manage risk can be substantially greater than the resources formally allocated to Risk and Compliance functions. Research published by TheCityUK and PwC UK in November 2025 estimated total regulatory compliance costs at over 13% of annual operating costs on average, compared with 2.6% in directly attributable costs, drawing on interviews and a survey of compliance leaders. The report focused primarily on conduct and financial-crime regulatory compliance; it did not measure the cost of all risk management activity or wider prudential requirements. The findings illustrate how much organisational activity can sit beyond dedicated compliance functions, reinforcing the importance of understanding the wider demand generated by risk management arrangements. TheCityUK and PwC UK report
I use the term Risk Demand to describe the total organisational activity required to manage risk, together with the additional activity generated by how risk is governed, evidenced and assured.
Individual functions may be adequately resourced while the overall operating model remains inefficient.
How Risk Demand accumulates
Risk management complexity rarely results from one poor design decision. More often, it develops through a series of individually reasonable responses to changing circumstances. Three forms of accumulation are particularly important.
1. Horizontal layering: multiple functions, one business activity
Consider a bank launching a new digital product. Multiple functions, including Compliance, Financial Crime, Cybersecurity and Data Privacy, may need to assess different exposures. For financial entities within its scope, the EU’s Digital Operational Resilience Act (DORA) imposes cross-functional requirements, particularly around ICT and third-party risk. Each function has legitimate responsibilities, but overlapping information requests, assessments and approval processes can create substantial cumulative workload, even when individual requirements appear proportionate in isolation. ESMA’s DORA overview
2. Vertical layering: the activity behind the control
A single risk requirement can generate multiple layers of activity, from control operation and evidence collection to monitoring, assurance and remediation. Each may serve a legitimate purpose, but their cumulative administrative burden can become disproportionate to the risk being managed.
In a LinkedIn poll of 140 respondents, 47% identified evidence and documentation as the greatest source of risk management administration, compared with issues and action tracking (18%), assessments and attestations (17%), and reporting and governance (16%).
While indicative rather than representative, these findings highlight an important distinction: the effort required to demonstrate that risks are being managed can become substantial relative to the effort devoted to managing them. This is particularly relevant when business teams must repeatedly provide similar evidence to different risk, compliance and assurance functions.
3. Temporal layering: new requirements without reconsidering old ones
Risk operating models also accumulate complexity over time. Regulatory developments, incidents and remediation programmes introduce new controls, assessments and reporting requirements that may remain long after the circumstances that justified them have changed. Emerging areas such as AI governance can reinforce this pattern when new frameworks are layered onto existing IT, model risk and data governance arrangements without reassessing their respective roles.
While organisations have clear triggers for adding requirements, retiring them often demands greater scrutiny and accountability. In a LinkedIn poll of 64 respondents, 31% identified the absence of a regular review process as the main barrier to retiring risk management activities, followed by fear of removing too much and regulatory expectations (25% each), and unclear ownership (18%).
These findings suggest that the mechanisms for reviewing and retiring requirements may be less developed than those for introducing them. Without periodic reassessment and clear accountability, individually justified activities can accumulate into an increasingly complex operating model.
Why restructuring may not address the underlying problem
When risk management capacity becomes stretched, organisations often consider moving responsibilities between the First and Second Lines, establishing embedded risk teams or centralising specialist capabilities.
Such changes can be valuable. Clear accountability, appropriate independence and access to specialist expertise are essential features of an effective operating model.
But moving an activity does not reduce the demand it creates.
Transferring a control assessment from the Second Line to an embedded First Line team changes who performs it. It does not establish whether the assessment is necessary, whether its scope is appropriate or whether similar information is already collected elsewhere.
In that context, restructuring should begin by examining the purpose and effectiveness of existing activities, rather than assuming that reallocating responsibilities will resolve capacity pressures.
Accountability arrangements can also influence Risk Demand. Under regimes such as the UK's Senior Managers and Certification Regime (SM&CR), the need to demonstrate reasonable steps may encourage extensive documentation and assurance. An effective operating model must preserve accountability and independent challenge while ensuring that activities remain necessary, proportionate and focused on meaningful oversight. FCA guidance on the Senior Managers Regime
Technology can accelerate complexity as well as reduce it
Artificial intelligence and automation can improve risk management efficiency by accelerating assessments, monitoring, reporting and control testing. However, automating a process does not establish whether every step is necessary or contributes to better decisions. Technology may reduce the cost of existing activities without addressing the underlying Risk Demand.
In a LinkedIn poll I conducted with 74 respondents, unclear ownership and governance was the most frequently identified limitation on the value of risk management automation (35%), followed by fragmented data and systems (29%) and poorly designed processes (25%). Limited skills and capabilities received 9%.
These findings reinforce the importance of examining the operating model before investing in technology. Automating overlapping assessments does not eliminate duplication, while more sophisticated monitoring may generate additional alerts, investigations and evidence requirements.
The objective should be to improve risk management effectiveness, not simply perform existing activities faster or at lower cost.
The connection to decision-making
Accumulated Risk Demand affects more than operating costs. Fragmented assessments, repeated hand-offs and unclear approval routes can delay business decisions, while extensive reporting from individual risk disciplines may fail to provide an integrated view of material exposures.
The resulting administrative workload can also divert capacity from investigating emerging concerns, exercising constructive challenge and responding to changing circumstances.
This creates a paradox. Organisations may devote increasing resources to managing risk while reducing the time and attention available to understand the risks that matter most.
The effectiveness of a risk operating model should therefore be tested against the decisions it is intended to support.
Does it help decision-makers understand the risks they are taking? Does it identify material concerns early enough to influence their choices? Does it preserve appropriate challenge while enabling timely action?
A model that produces comprehensive documentation but struggles to influence decisions may be administratively mature without being effective.
A different starting point for operating model reviews
Understanding Risk Demand requires organisations to examine risk management from the perspective of business activity, rather than only through the structures of individual functions. A practical review should address several questions:
What activities are being performed, and why? Identify the regulatory, risk management, governance or assurance purpose behind significant requirements.
Where does demand accumulate? Examine how specialist functions, business teams and assurance providers interact around the same processes and decisions.
Which activities overlap? Determine whether similar information, evidence or assessments are being requested repeatedly without sufficient additional value.
Are requirements still proportionate? Reassess whether controls, reporting and governance arrangements remain appropriate to current exposures and business circumstances.
Who can simplify or retire activities? Establish clear accountability for challenging requirements that may no longer be necessary, while maintaining appropriate regulatory and risk oversight.
What should be improved before automation? Distinguish activities that should be automated from those that should first be redesigned, consolidated or discontinued.
The objective is not to minimise risk management activity. Some organisations may need stronger controls or additional specialist expertise; others may benefit from consolidating assessments, simplifying governance or retiring requirements that no longer serve their purpose.
Effective operating model design requires attention to both sides of the equation: the supply of people, capabilities and technology, and the demand generated by risk management arrangements.
Making risk management more effective
Financial institutions face legitimate pressure to demonstrate robust governance, effective controls and compliance with regulatory expectations. Those responsibilities cannot be reduced to a cost-efficiency exercise.
Nevertheless, increasing the resources devoted to risk management is not always the answer to growing workload.
This requires examining the risk management operating model as a connected system, including the activities performed across business teams, specialist functions, management and assurance. This is also central to the approach taken by Aevitium in assessing operating model design and effectiveness.
This points towards an important principle. Risk management requirements should not only have clear mechanisms for introduction and escalation. They should also be subject to periodic challenge, reassessment and, where appropriate, retirement.
This requires organisations to understand how risk management activity is generated, how it accumulates and whether it continues to serve its intended purpose.
For boards and executive teams reviewing their risk management capabilities, this offers a different starting point:
Before asking how much more risk management capacity is required, understand how much Risk Demand the organisation is generating, and whether that demand is improving the decisions that matter.
About the author
Julien Haye is the founder and Managing Director of Aevitium LTD, a strategic risk and governance advisory practice. A former Chief Risk Officer, he advises organisations on risk management effectiveness, governance, operating models and organisational resilience. He is the author of The Risk Within and Resilient Risk Management, and hosts the RiskMasters Podcast.