2027 ProSight Risk Outlook Survey

1. Thank you in advance for participating in the 2027 ProSight Risk Outlook Survey, conducted in collaboration with Oliver Wyman. We’ll aggregate your responses with those of your peers to create a valuable benchmarking resource for the industry. Your insights into current and emerging risks and budget priorities inform decisions essential to the safety and soundness of banking.

The survey takes about 10 minutes to complete. All responses and the names of participating respondents and their institutions are confidential.

If you have any questions, please contact:

Celina Rogers
Editorial Director, Content Development & Publishing
ProSight Financial Association
crogers@ProSightFA.org

As a thank you for completing this survey, participants will receive exclusive early access to the study's key findings before they are publicly released. To receive your copy, please complete the survey and enter your email address below.

2. 1. What is the size of your institution (in assets, USD)? (Please select one.) *This question is required.

3. 2. What is the current size of the employee workforce at your institution? (Please select one.)

4. 3. What is the size of your institution’s risk function? (Please select one.)

5. 4. Which of the following entities is your primary regulator? (Please select one.) *This question is required.

Please enter an 'other' value for this selection.

6. 5. Which of the following best describes your role? (Please select one.) *This question is required.

7. 6. How involved is the risk function in driving your organization's overall strategy?
*This question is required.

Please enter an 'other' value for this selection.

8. 7. What are your organization’s top three risks (i.e., risks that are currently your organization’s major areas of focus and resource allocation)? (Please select up to three.) *This question is required.

9. 8. What are your top three emerging risks (i.e., risks that have high potential to become one of your top risks a year or two from today)? (Please select up to three.) *This question is required.

10. 9. In your view, what is the most consequential yet underestimated risk facing the financial services industry today?

11. Please complete the sentence with the answer that best describes your views. (Please select one for each statement.)

10. In general, the U.S. macroeconomic environment will be ___________ in 2027, compared to 2026.

12. 11. In general, the U.S. consumer credit environment will be __________in 2027, compared to 2026.

13. 12. In general, the U.S. commercial credit environment will be __________in 2027, compared to 2026.

14. 13. How has your risk budget changed in fiscal year 2026 compared to fiscal year 2025? (Please select one in each row.)

Space Cell	Decreased 5% or more	Stayed about the same (i.e., within 5% of current budget)	Increased 5% or more	Unsure
Overall risk organization	Overall risk organization: Decreased 5% or more	Overall risk organization: Stayed about the same (i.e., within 5% of current budget)	Overall risk organization: Increased 5% or more	Overall risk organization: Unsure
Credit risk	Credit risk: Decreased 5% or more	Credit risk: Stayed about the same (i.e., within 5% of current budget)	Credit risk: Increased 5% or more	Credit risk: Unsure
Market risk	Market risk: Decreased 5% or more	Market risk: Stayed about the same (i.e., within 5% of current budget)	Market risk: Increased 5% or more	Market risk: Unsure
Liquidity risk	Liquidity risk: Decreased 5% or more	Liquidity risk: Stayed about the same (i.e., within 5% of current budget)	Liquidity risk: Increased 5% or more	Liquidity risk: Unsure
Operational and operational resilience-related risk (including fraud and scam risk)	Operational and operational resilience-related risk (including fraud and scam risk): Decreased 5% or more	Operational and operational resilience-related risk (including fraud and scam risk): Stayed about the same (i.e., within 5% of current budget)	Operational and operational resilience-related risk (including fraud and scam risk): Increased 5% or more	Operational and operational resilience-related risk (including fraud and scam risk): Unsure
Cyber/technology risk	Cyber/technology risk: Decreased 5% or more	Cyber/technology risk: Stayed about the same (i.e., within 5% of current budget)	Cyber/technology risk: Increased 5% or more	Cyber/technology risk: Unsure
Compliance / AML risk	Compliance / AML risk: Decreased 5% or more	Compliance / AML risk: Stayed about the same (i.e., within 5% of current budget)	Compliance / AML risk: Increased 5% or more	Compliance / AML risk: Unsure
Enterprise risk	Enterprise risk: Decreased 5% or more	Enterprise risk: Stayed about the same (i.e., within 5% of current budget)	Enterprise risk: Increased 5% or more	Enterprise risk: Unsure

15. 14. What is your risk organization’s annual budget for 2026? (Please enter a number or range in the text box below.)

16. 15. Looking ahead, what change, if any, do you expect annually in your risk organization’s budget over the next three years? (Please select one in each row.)

Space Cell	Decrease 5% or more	Stay about the same (i.e., within 5% of current budget)	Increase 5% or more	Unsure
Overall risk organization	Overall risk organization: Decrease 5% or more	Overall risk organization: Stay about the same (i.e., within 5% of current budget)	Overall risk organization: Increase 5% or more	Overall risk organization: Unsure
Credit risk	Credit risk: Decrease 5% or more	Credit risk: Stay about the same (i.e., within 5% of current budget)	Credit risk: Increase 5% or more	Credit risk: Unsure
Market risk	Market risk: Decrease 5% or more	Market risk: Stay about the same (i.e., within 5% of current budget)	Market risk: Increase 5% or more	Market risk: Unsure
Liquidity risk	Liquidity risk: Decrease 5% or more	Liquidity risk: Stay about the same (i.e., within 5% of current budget)	Liquidity risk: Increase 5% or more	Liquidity risk: Unsure
Operational and operational resilience-related risk (including fraud and scam risk)	Operational and operational resilience-related risk (including fraud and scam risk): Decrease 5% or more	Operational and operational resilience-related risk (including fraud and scam risk): Stay about the same (i.e., within 5% of current budget)	Operational and operational resilience-related risk (including fraud and scam risk): Increase 5% or more	Operational and operational resilience-related risk (including fraud and scam risk): Unsure
Cyber/technology risk	Cyber/technology risk: Decrease 5% or more	Cyber/technology risk: Stay about the same (i.e., within 5% of current budget)	Cyber/technology risk: Increase 5% or more	Cyber/technology risk: Unsure
Compliance / AML risk	Compliance / AML risk: Decrease 5% or more	Compliance / AML risk: Stay about the same (i.e., within 5% of current budget)	Compliance / AML risk: Increase 5% or more	Compliance / AML risk: Unsure
Enterprise risk	Enterprise risk: Decrease 5% or more	Enterprise risk: Stay about the same (i.e., within 5% of current budget)	Enterprise risk: Increase 5% or more	Enterprise risk: Unsure

17. This section asks questions about the regulatory changes you have observed as well as your expectation for regulatory priorities over the next 12 months.

16. To what extent do you agree or disagree with the following statement?

“Regulatory scrutiny/requirements for our institution have become less prescriptive in terms of how risk processes are performed and more focused on risk management outcomes in the past 12 months.” *This question is required.

18. 17. Where have you noticed pullback in regulatory pressure over the past 12 months? (Please select up to three risk/compliance areas.)
*This question is required.

19. 18. Where do you expect regulatory pressure to intensify the most over the next 12 months? (Please select up to three risk/compliance areas.)

20. Some banks are responding to the current environment by optimizing programs and removing low-value or redundant activities that do not reduce risk. The following questions intend to capture the extent to which your bank is undertaking these near-term initiatives (next ~12 months).

To what extent do you agree or disagree with the following statement? (Please select one.)

19. “In light of changes in the operating environment, we see an opportunity to optimize risk processes at our institution.”

21. 20. In response to the current banking environment, where does your organization plan to optimize risk programs in the next 12 months? (Please select all that apply.)

22. 21. If your organization has already begun optimizing risk programs, which activities is your organization undertaking? (Please select all that apply.)

Eliminating duplicative reviews (checking the checker)
Eliminating or consolidating risk committees
Reconfiguring where the work gets delivered (e.g., centralizing the work into a shared service)
Reallocating the ownership of execution (e.g., outsourcing activities to third parties, reallocating work across different roles)
Altering how the work is executed (e.g., automating repeatable tasks, augmenting decision making with AI tools)
Other (please specify) Please enter an 'other' value for this selection.

23. Some banks are beginning to explore leveraging transformational technology (including AI) to re-imagine core risk programs and processes from the bottom-up over the medium term (next 2-3 years). The following questions intend to capture the extent to which your bank is undertaking these initiatives.

22. To what extent will the following objectives drive your institution’s efforts to transform its risk management programs? (Please select one in each row.)

Space Cell	Very important objective	Somewhat important objective	Not especially important objective
Improve overall quality of risk management	Improve overall quality of risk management: Very important objective	Improve overall quality of risk management: Somewhat important objective	Improve overall quality of risk management: Not especially important objective
Respond to risk events (including new/emerging risks) more quickly and decisively	Respond to risk events (including new/emerging risks) more quickly and decisively: Very important objective	Respond to risk events (including new/emerging risks) more quickly and decisively: Somewhat important objective	Respond to risk events (including new/emerging risks) more quickly and decisively: Not especially important objective
Improve cost efficiencies	Improve cost efficiencies: Very important objective	Improve cost efficiencies: Somewhat important objective	Improve cost efficiencies: Not especially important objective
Enter another option	Other: Very important objective	Other: Somewhat important objective	Other: Not especially important objective

24. 23. Where does your organization see the greatest opportunity to fundamentally transform risk programs/processes over the next 2-3 years using AI? (Please select up to three.)

25. 24. Which of the following best describes your current AI usage within your risk function? (Please select one.)

26. 25. What specific use cases for AI have you developed for the risk function? (Please enter a few sentences or phrases in the text box below.)

27. 26. Does your institution measure the ROI of its investments in AI for the risk function? (Please select one.)

28. 27. What metrics does your institution use to measure the return on its investments in AI for the risk function? (Please enter a few sentences or phrases below.)

29. 28. How well have your institution’s investments in AI for the risk function performed? (Please select one in each row.)

Space Cell	Exceeded expectations	Met expectations	Fell short of expectations	Too soon to tell/Unsure
Improved overall quality of risk management	Improved overall quality of risk management: Exceeded expectations	Improved overall quality of risk management: Met expectations	Improved overall quality of risk management: Fell short of expectations	Improved overall quality of risk management: Too soon to tell/Unsure
Responded to risk events (including new/emerging risks) more quickly and decisively	Responded to risk events (including new/emerging risks) more quickly and decisively: Exceeded expectations	Responded to risk events (including new/emerging risks) more quickly and decisively: Met expectations	Responded to risk events (including new/emerging risks) more quickly and decisively: Fell short of expectations	Responded to risk events (including new/emerging risks) more quickly and decisively: Too soon to tell/Unsure
Improved cost efficiencies	Improved cost efficiencies: Exceeded expectations	Improved cost efficiencies: Met expectations	Improved cost efficiencies: Fell short of expectations	Improved cost efficiencies: Too soon to tell/Unsure

30. 29. What are/have been the primary obstacles to greater adoption of AI within your risk function? (Please select up to three.)

31. 30. How well developed are the following attributes of your institution’s AI framework? (Please select one in each row.)

Space Cell	Highly developed	Somewhat developed	Not developed	Not sure
AI risk appetite	AI risk appetite: Highly developed	AI risk appetite: Somewhat developed	AI risk appetite: Not developed	AI risk appetite: Not sure
AI policies/standards	AI policies/standards: Highly developed	AI policies/standards: Somewhat developed	AI policies/standards: Not developed	AI policies/standards: Not sure
AI controls	AI controls: Highly developed	AI controls: Somewhat developed	AI controls: Not developed	AI controls: Not sure
AI technology infrastructure	AI technology infrastructure: Highly developed	AI technology infrastructure: Somewhat developed	AI technology infrastructure: Not developed	AI technology infrastructure: Not sure
AI risk framework (e.g., governance, risk tiering, MRM validation)	AI risk framework (e.g., governance, risk tiering, MRM validation): Highly developed	AI risk framework (e.g., governance, risk tiering, MRM validation): Somewhat developed	AI risk framework (e.g., governance, risk tiering, MRM validation): Not developed	AI risk framework (e.g., governance, risk tiering, MRM validation): Not sure
AI upskilling/training	AI upskilling/training: Highly developed	AI upskilling/training: Somewhat developed	AI upskilling/training: Not developed	AI upskilling/training: Not sure
AI cost management / FinOps	AI cost management / FinOps: Highly developed	AI cost management / FinOps: Somewhat developed	AI cost management / FinOps: Not developed	AI cost management / FinOps: Not sure

32. 31. Are you willing to participate in a brief follow-up conversation (approximately 15–20 minutes) to provide additional insights for this research? Your survey responses will remain confidential whether or not you choose to participate in a follow-up interview.

Please enter an 'other' value for this selection.