# 320. The digital twin: Reimagining non-financial risk management - **Show:** Inside the Strategy Room - **Published:** 4 Sep 2026 - **Source:** https://omny.fm/shows/inside-the-strategy-room/320-the-digital-twin-reimagining-non-financial-risk-management - **Transcript:** https://podcasts.opennash.com/shows/inside-the-strategy-room/320-the-digital-twin-reimagining-non-financial-risk-management-8db23e/ - **Provider:** OpenNash Podcasts (machine-generated) ## In brief The episode argues that adding more people and controls has not made non financial risk (operational, technology, vendor and conduct risk) any safer, and that AI has made the problem faster and more tangled. The guests propose a "digital twin": a live, AI-monitored replica of a bank's processes, risks, controls and vendors that can spot failures and simulate shocks before they happen. The central tension is ambition versus reality. Nobody has built a full enterprise twin yet, and the guests say so openly. They present it as a north star rather than a finished product, and argue that banks should not wait for perfect data. Start with one process and the risk and control self assessment, and let AI help build the foundations.] ## Key insights 1. **More risk spending has not improved outcomes** McKinsey's benchmark shows operational risk staff grew roughly 11% a year from 2020 to 2023, yet only a small share of institutions say operational risk beats its productivity target. The problem is structural, so more controls and people do not fix it. 2. **Banks cannot see their hidden vendor dependencies** Only about a quarter of banks can map fourth and fifth parties end to end, and one provider can support more than thirty processes. Without that map, a single vendor failure can spread across the bank unseen. 3. **Other industries already offer working risk patterns** Ecommerce automates routine checks, energy firms expect peer accountability, airlines share near-miss data, healthcare measures outcomes, and nuclear utilities model failures digitally. Banking has adopted these only to a limited degree. 4. **A digital twin turns controls into live signals** In the loan example, an agent notices a failed income check and blocks affected disbursements immediately, rather than the problem surfacing months later in an audit or loss. The same live model supports daily risk assessments and instant read-across of similar exposures. 5. **Start with one process, not a perfect enterprise** The guests advise building the risk and control self assessment as the backbone and trying one well-understood process such as lending end to end. AI can generate first versions of inventories, so waiting years for perfect data is unnecessary. ## Questions this episode answers ### What is a digital twin in banking risk management? It is a live digital replica of a bank's processes, the risks in each step and the controls meant to manage them. Anke Raufuss and Laura Webanck describe agents monitoring it continuously so deviations and failures are caught early and changes can be simulated. ### Has any bank actually built a full digital twin? No. Björn Nilsson said a full enterprise twin is not in production anywhere, and Webanck said she knows of no institution that has built it, though some banks run individual components such as third-party concentration mapping. ### Why hasn't spending more on risk teams made banks safer? Raufuss cited McKinsey benchmarks showing big growth in risk staff and capital requirements without better productivity results. Webanck added that current risk programs were built piecemeal over time and would never be designed that way from scratch. ### What is a risk and control self assessment, and why does it matter here? It is an exercise, usually yearly, where a business area lists what could go wrong in its processes and checks it has the right preventive and detective controls. Webanck says it is the best starting backbone for a digital twin, which would keep it updated continuously. ### How should a company start without perfect data? Pick one high-value, well-understood process such as lending or client onboarding and map its risks and controls end to end, as Nilsson advised. Webanck said existing procedures, industry references and common AI models can build a first version without a new data platform. ## Facts - **Anke Raufuss** [0:04:02]: "capital requirements for operational risk rose 50% in Europe over two years." - **Anke Raufuss** [0:01:50]: "Someone in Australia, very innovative bunch of people, was tired of racing to book a spot in a popular pilates class." - **Anke Raufuss** [0:02:21]: "It found a vulnerability, uh, in the gym's booking system, manipulated the wait list and canceled someone else's reservation to move its owner up the queue." - **Anke Raufuss** [0:07:47]: "8.5 million devices globally not getting the right updates in time and causing an estimated five, more than 5 billion damage, uh, to fortune 500 companies." - **Anke Raufuss** [0:08:18]: "a bank's non essential IT activities were being paused for for six months after a series of system failures." - **Björn Nilsson** [0:13:05]: "third party risk meant that you had a due diligence questionnaire that you did for your top, uh, forty to fifty vendors." - **Björn Nilsson** [0:14:25]: "only a quarter of the banks can map end to end their fourth and fifth parties" - **Björn Nilsson** [0:14:58]: "we've seen also that individual providers present more than thirty processes across a single bank." - **Björn Nilsson** [0:17:07]: "airlines, um, they, for instance, contribute incident data to a common exchange, so every operator then benefits also from from each other's near misses." - **Björn Nilsson** [0:17:53]: "quality, for instance, is measured in terms of patient outcomes in the healthcare industry." - **Björn Nilsson** [0:18:31]: "nuclear utilities, they tend to build also digital instances of their physical infrastructure." - **Björn Nilsson** [0:21:33]: "there's a full enterprise twin is not yet in production anywhere." - **Laura Webanck** [0:22:42]: "Factories have been doing this for twenty or so years, uh, in a factory setting, a digital twin is is a virtual representation of the production line" - **Laura Webanck** [0:23:10]: "In factories, what you can do is predictive maintenance. You can spot where a piece might be wearing out, you can identify bottlenecks" - **Laura Webanck** [0:25:14]: "In the twin, an agent would detect the failed control and block disbursement of the loan for all the affected applications." - **Laura Webanck** [0:30:19]: "A risk and control self assessment is, uh, an exercise. It's usually done once a year, but ideally more often" - **Laura Webanck** [0:33:08]: "in in one pilot with a client, we identified almost 200 concentration risks, and we identified one provider that was supporting more than thirty processes" - **Laura Webanck** [0:31:50]: "maybe you do eight tests or tabletop exercises a year to know how you would perform in a stress scenario." - **Laura Webanck** [0:40:56]: "It's some Python code right now that sits on top of your other systems. You don't necessarily need a data lake, you don't need to build a new system." - **Laura Webanck** [0:38:30]: "Gen AI can pressure test with a what we call a challenger RCSA, where you provide some of the raw information and agents, then build an RCSA sort of in parallel" ## Transcript **[0:00:01] Laura Webanck:** It's worth noting that no financial institution that I'm aware of has built this yet. I actually think the digital twin is less of a proof point and more of an answer to the question, How do I think about an AI enabled, non financial risk transformation journey? What is my north star? **[0:00:25] Sean Brown:** For McKinsey and Company, I'm Sean Brown and welcome to inside the strategy room. The complexity and pace of non financial risk today is expanding and accelerating. Incidents are cascading in hours rather than days or weeks, and the fallout is now often more wide-ranging. Yet, despite increasing controls, investments and headcount, risk outcomes are not improving. Can an AI enabled digital twin help organizations reimagine their non financial risk management? And if so, what are some of the first steps risk leaders should take? **[0:01:02] Sean Brown:** Today, we're joined by three of our risk and resilience experts to unpack these digital developments. Anke Raufuss is a senior partner in our Sydney office and a key leader of our Asia risk and resilience practice. She's also the global leader of our work in non financial and market risk. Bjorn Nielsen is a partner in our Stockholm office and a leader in our global non financial risk service line. And Laura Webanck is a partner in our New York office and leads our risk and control service line in the Americas. **[0:01:32] Sean Brown:** Welcome everyone. Anka, maybe you could set the scene for us. Non financial risk is a topic that's getting a lot of media attention right now, and it's a top of mind concern for many business leaders. What has changed in the risk management landscape recently to warrant this focus? And and why the sense of urgency? **[0:01:50] Anke Raufuss:** Thank you. Indeed, the risk management landscape is changing, and in particular, in a technology digital AI enabled world, we need to be faster in the way we manage non financial risk. Maybe, like, let me tell you a little story from this week's newspaper that made me laugh initially, but then also made me a little bit nervous. Someone in Australia, very innovative bunch of people, was tired of racing to book a spot in a popular pilates class. **[0:02:21] Anke Raufuss:** So they asked, uh, an AI agent to handle it, uh, and the AI agent actually succeeded brilliantly. It found a vulnerability, uh, in the gym's booking system, manipulated the wait list and canceled someone else's reservation to move its owner up the queue. And when asked why, the agent's response was essentially the system let me do it, so I did it. You're welcome. So now, Pilates, that's low stakes. But if you close your eyes and imagine some same behavior happening with an AI agent in a bank, that's obviously more malicious and, uh, really not helpful. **[0:02:57] Anke Raufuss:** Think about a lending process where suddenly there's there's someone bypassing some maker checker, uh, controls. But the world in which we're entering has increased non financial risk and accelerated non financial risk. **[0:03:11] Sean Brown:** That story really illustrates for me how an innocent request by a user of an agent could still increase the threat landscape. So, with these accelerating challenges in managing non financial risks, how successfully are you seeing organizations respond? **[0:03:28] Anke Raufuss:** Maybe let me start with some uncomfortable truth about where we are today. We've invested massively in non financial risk and the the outcomes have not improved. Our global risk productivity benchmark, uh, tells a stark story. Operational risk FTEs grew approximately eleven per year between 2020 and twenty three, faster than virtually any other risk type. And teams responsible for IT risk, third party risk, data risk, cyber risk, grew forty to 130% in just three years. **[0:04:02] Anke Raufuss:** Similarly, capital requirements for operational risk rose 50% in Europe over two years. And the result? So what's the impact of that? Only four of institutions in our, uh, flash survey report say that operational risk exceeds its productivity target. So the impact of this increase in in uh resources does not show this is not for lack of effort or good intentions. Um, there is really a lot of investment, a lot of, uh, positive movements happening, but, uh, they're still also working towards the tide of 20,000 controls. **[0:04:40] Anke Raufuss:** And how do we test all of them? And the positive thing is this is all possible to improve with the help of AI. **[0:04:50] Sean Brown:** And I'm really looking forward to talking more about those improvements. But before we do Anka, I understand this is coming to the foreign banking. Um, and it would be great if you could also explain how the concept of non financial risk extends across other sectors. What does it look like, for example, in more physical industries like mining? **[0:05:08] Anke Raufuss:** Yes, absolutely. So the use of AI, or also of agents or or of digital twins, we've seen it, uh, in heavy, high volume processes, in very predictable processes like in in mining, your supply chain management. You can really map it out, uh, the whole process throughout and and can nearly determine and predict what is what is going to happen, also what needs to happen in order for, uh, the supply being being very smooth. So we've learned a lot from that. **[0:05:40] Anke Raufuss:** We learn a lot from the aviation industry, for example, regarding their safety culture, uh, so more the behavioral aspects, uh, that we can, uh, that we can draw on there, that everyone has it in their DNA, how to walk down a stairs. I've, I'm always, um, uh, amazed by seeing that everyone directly grips the handrail. It's just part of the DNA. So there's there's both structural elements and, uh, technical elements that we can, um, learn and adopt for banking, but also some of the behavioral, um, uh, practices. **[0:06:15] Sean Brown:** Thanks, Anka and and Laura, any thoughts you'd like to add here? What kind of opportunities, for example, are there for the banking industry to rethink their approach to managing non financial risks? **[0:06:26] Laura Webanck:** Um, maybe I'll share two reflections. One is the idea that in a lot of these physical, uh, industries, there is less the concept of compliance, uh, following the rules and more a culture of safety and people actually feeling empowered to use judgment. And I think there's this idea of how do we, how do we bring that more into our professional services industries? Um, my other, my other reflection is a lot of the way that we do risk management and non financial risk today. **[0:06:58] Laura Webanck:** And I think it's evidenced by this. No matter how many people we throw at the problem, it doesn't necessarily get better. It's built, um, it's been p built piecemeal over a long period of time. And if you were to start with a fresh piece of paper, you would never build it the way it is actually operated today. And so there's really this opportunity to step back and say, what are the outcomes that we really wanna achieve, and how can we build different and better? **[0:07:27] Laura Webanck:** Now that we have this, you know, you know, moment of inflection with with AI. **[0:07:34] Sean Brown:** Thanks, Laura and Anka. Maybe you could talk a little more about the impetus to, as Laura suggests, reimagine the approach to non financial risk in this AI moment. Maybe you could share some examples that could help bring this to life. **[0:07:47] Anke Raufuss:** Uh, when something does go wrong today, it really goes wrong fast and big. And the examples have been on all of our minds and made us rethink, uh, and test our own controls in the respective, uh, areas. If you think about the widely deployed endpoint security tool crashing, uh, and uh, 8.5 million devices globally not getting the right updates in time and causing an estimated five, more than 5 billion damage, uh, to fortune 500 companies. **[0:08:18] Anke Raufuss:** Just the the the scale of that impact, uh, in a very connected world, uh, huge. Or, as another example, a bank's non essential IT activities were being paused for for six months after a series of system failures. I think there's a common pattern around speed and interconnectivity and transparency. When a signal becomes a serious incident in hours, not weeks, that's a challenge. Um, a failure in one vendor or one system can cascade, uh, across business lines or geographies, or or legal entities, and most institutions generally do not have full visibility of their full exposure. **[0:09:02] Anke Raufuss:** That's exactly why a good answer, the answer can't be just more controls, more people. The problem is really structural, and we need to solve it in a in a more structural way. And that's that's the why behind the digital twin. **[0:09:16] Sean Brown:** Thanks, and this might be a good moment to define what a digital twin really is. Anka, maybe you could explain that for us. **[0:09:22] Anke Raufuss:** So digital twin is basically just a a replica of your existing operations, and we've been m mapping processes and maintaining them live and and and up to date. Um, but it is a long process, uh, but um, it is a long process, uh, along business activities that risks arise and where also you need to, uh, add controls to a business process. So it's basically, uh, a replica of reality in which you can foresee and, um, potential issues in the future, where you have a a, nor a normal, a baseline of how it should work. **[0:10:01] Anke Raufuss:** And can think about deviations from the from the baseline, just as they don't hopefully occur, or w which helps you prevent in real life. **[0:10:12] Sean Brown:** And you and Laura have both made the point that progress on non financial risk targets hasn't necessarily followed an increase in resources. So if headcount isn't the lever, how does the digital twin help close that gap? And and what is the productivity metric that one might wanna look at here? **[0:10:29] Anke Raufuss:** It's a very good question, and I I do think everyone is grappling with how do I demonstrate the value of managing non financial risk, which technically is often phrased as, yeah, protecting from downside. That's one angle to it. The good old counting losses is a very lagging indicator for it, but ideally you have more leading, uh, indicators that you really can demonstrate that you've identified early some of the potential issues that could have materialized in an incident, so some of the non non materialized incidents, um, and and having track on on that, yeah. **[0:11:09] Laura Webanck:** If I could add to that, I also think that there's some wisdom in the saying that breaks are the controls on your car that let you go fast. And as we look at how AI, not from a risk management perspective, but just from a business perspective, will start allowing organizations to move much faster in developing updates, in releasing code, in developing products, and in competing in a landscape where others are also moving quite fast. Having a real time view, having more confidence in your control environment is going to allow you to more confidently compete at the speed of the market. **[0:11:56] Laura Webanck:** And so it becomes really critical to the business and not just to risk management. **[0:12:01] Sean Brown:** And Bjorn, anything you'd like to add here? **[0:12:03] Björn Nilsson:** Yeah, I think w what is making this possible now? That you could build basically a replica of the bank with the different processes, with the different risk, the different controls. And you can do simulation before an event actually happens. That that really, we are now at the stage where the technology can really enable us to do that. And therefore also be more proactive in the risk management and test things before they before the failures actually happen. **[0:12:32] Björn Nilsson:** So, uh, so I'm I'm very m m confident that the future of non financial risk management and how we think about risk will will be materially different than it. Um, the still rather manual processes that, uh, we're relying on today. **[0:12:46] Sean Brown:** Super, and Bjorn. Today, many banks are operating with supplier and vendor networks that are becoming increasingly complex. So I was hoping maybe you could share an example of how this complexity and the speed of non financial risk exposure is actually demanding a different approach than it was, say, five to ten years ago, **[0:13:05] Björn Nilsson:** Yes, so, um, so one dimension that makes non financial risk fundamentally different today is, as you say, the dependency of, uh, the banking sector on, uh, complex vendor systems. Because it's really reshaping the risk picture across every institution that we work with. Uh, if you consider five to ten years ago, um, third party risk meant that you had a due diligence questionnaire that you did for your top, uh, forty to fifty vendors. But today, those forty to fifty vendors that you have, they in themselves also depend on further layers of providers and third parties. **[0:13:44] Björn Nilsson:** So cloud shared data infrastructure, communications providers, different models, so, uh, so the map in the sector has really become very entangled. And um, what we often then observe is that banks can name their third parties, so their direct third parties. Most can also name their fourth parties, but very few can actually take a single critical provider and identify every process across the bank which depend on that single provider. So so, also looking at some of the numbers from our recent CRO flash survey, just to make this a bit more concrete. **[0:14:25] Björn Nilsson:** Um, only a quarter of the banks can map end to end their fourth and fifth parties, so only a quarter of the banks, six out of ten. They also acknowledge that they have very limited visibility in embedding upstream or or software. So how? How does actually software that are, um, that are vendors or or third party providers use? How does that affect us? And even where they then collect the fourth party in i information, um, only a quarter can translate that into actual management decisions. **[0:14:58] Björn Nilsson:** So, I mean, the the the dynamics here is that there's first, more interdependencies, um, so we've seen also that individual providers present more than thirty processes across a single bank. Um, and there's no single owner in the bank that has a view of all of the different, um, the the different interdependencies. And then second to interdependencies, then speed. So what used to be a slow moving incident chain is now r really a very quick escalation. So a vendor issue to an escalation to different disclosures that you need to provide within hours rather than than days. **[0:15:40] Björn Nilsson:** So the matters really, really escalate quickly now today as well. **[0:15:44] Sean Brown:** right? And so how is this kind of risk complexity being managed in industries other than banking? Anka mentioned, for example, there are other industries that have already been doing this for some time. **[0:15:57] Björn Nilsson:** Sure, so, um, I mean, if we step outside of banking, as as we were speaking about, other industries have have been managing this systemic, interdependent risks, uh, under uncertainty for for a long period of time. And there are, I would say, five patterns, um, from them, that that, uh, we think are also directly relevant for how we can reimagine now non financial risk also in the financial sector. The first one that I would highlight is, uh, taking an example from e commerce sector. **[0:16:30] Björn Nilsson:** They tend to automate routine work, not only because it's cost efficient, but also where you have repe repetitive work for humans. Uh, there's also typically weaknesses in the control process, so errors occur when people get tired. And the lessons, um, for us, um, is that m many controls are still manual, maybe because they've always been manual, but not because manual is is a good thing. So looking for way to automate the routine work is, uh, is a key learning from, uh, from other industries. **[0:17:07] Björn Nilsson:** The second thing I would call out is to really embed a genuine risk culture that also puts focus on peer accountability. So in energy sector, where they're operating major facilities, oil rigs, there's an expectation that every employee holds others accountable, uh, also to safety standards. Then, thirdly, there are industries that are better at sharing also risk signals with their peers than, uh, the banking sector. So airlines, um, they, for instance, contribute incident data to a common exchange, so every operator then benefits also from from each other's near misses. **[0:17:53] Björn Nilsson:** Um, in banking, we do this, uh, to a limited degree, though, but it's primarily in regulatory led exercises, but it's not at the same scale and and velocity as as we see in other industries. I think the fourth one is then, uh, also to measure the outcomes rather than the actual compliance to procedures. So that quality, for instance, is measured in terms of patient outcomes in the healthcare industry. And whether the treatment actually worked is not whether a particular checklist was followed, uh, fully, a clinical checklist, and then maybe the last one. **[0:18:31] Björn Nilsson:** If we think about the advanced industries like, uh, nuclear utilities, they tend to build also digital instances of their physical infrastructure. Um, so that they can also model how a single failure then propagates before it occurs in the real world. So that is also a capability that we need to deploy more in banking. **[0:18:53] Sean Brown:** And how is the technology itself evolving to enable this? Uh, does AI offer a systematic approach to the mapping and risk assessments that we were discussing previously? And how does this all lead us to the digital twin? **[0:19:07] Björn Nilsson:** Yes, there's the fundamental basis for running non financial risk management differently than before. So, I mean, if you were to ask a year ago, no, maybe not a year ago, but three to five years ago, whether whether we can make risk assessments dynamic, make them real time, most would have said no. I mean, you could. You can stitch the data that you need for it fully together, but you couldn't run the actual computations and simulations behind it. **[0:19:37] Björn Nilsson:** You didn't really have the capability also to take all this data in. Make sure that you can also convert signals or read signals out of the data and and do recommendations based on it. So, but I think these constraints have have now eased significantly. I think there's four major shift that is, uh, that that we're now seeing. So, I mean, first is that we're moving them from manual processes to automated actions. And then leaving the human effort to focus on on the real risks that matter. **[0:20:11] Björn Nilsson:** So, genuine, genuine judgment calls where those those need to be made. Second shift that we're seeing is that we we are moving more from this point in time assessment to, uh, more dynamic decisions. And then, thirdly, uh, we move them from backward looking to more proactive management. And then, lastly, uh, we're shifting also from more sort of judgment based to objective risk management. Um, because we're not sort of replacing expert judgment with with a machine, but it's, um, judgment is made then more essential for where the actual tail risks are. **[0:20:51] Björn Nilsson:** So we can sort of expand the evidence base, um, and reduce variance in routine decisions, um, by letting a a a machine take the really routine decisions that are of low risk. If you put all of these four together, I think you start to see sort of something that looks like a digital twin of a bank. So really like a a live, connected model of different processes, risks, controls, third parties, uh, with then agents actually monitoring and and acting on top of it. **[0:21:26] Sean Brown:** So, are there any examples of full digital twins yet, or is this still being evolved and and constructed? **[0:21:33] Björn Nilsson:** Yes, so I mean, the there's, uh, there. There's multiple banks that are, uh, needed in order to to run this today. So, I mean, there are, I would say that there's a full enterprise twin is not yet in production anywhere. So, uh, we should be transparent about that. But there are, uh, banks that are running multiple of the components that are needed for a digital twin today. So, like agentic RCS, uh, RCS, a pilots, uh, third party concentration mapping, live control, monitoring, looking into origination and payments and monitoring. **[0:22:11] Björn Nilsson:** Um, so, uh, so, so I think there's multiple bits and pieces of a digital twin. So basically a replica of the bank, um, in a digital version, where you can also simulate, uh, how changes to processes and risks actually then impact your risk profile. **[0:22:29] Sean Brown:** Thanks, Bjorn and Laura. I know our listeners would be keen to hear more about what this looks like in practice. Perhaps you could give us a little bit more detail on how a digital twin works in a banking context. **[0:22:42] Laura Webanck:** All right, so let's go deeper, uh, into the idea of a digital twin. Um, as we've mentioned, this isn't a novel concept. Factories have been doing this for twenty or so years, uh, in a factory setting, a digital twin is is a virtual representation of the production line, where it's hooked up to live sensors that track anything from temperature, electricity usage, quality output. And you can immediately see the value in understanding how things are operating in real time. **[0:23:10] Laura Webanck:** In factories, what you can do is predictive maintenance. You can spot where a piece might be wearing out, you can identify bottlenecks to figure out where delays are coming from. You can also test changes and new layouts before making updates. So we'll explore the concept for banking, but the concept can apply for any number of industries and is already in practice in a number of them. Imagine a bank's processes, risks and controls represented live, with agents continuously, uh, updating and acting. **[0:23:43] Laura Webanck:** The moment a control fails, without a human have having to initiate a check and do a bunch of analysis. And we can start with, uh, a retail loan origination example to make this concrete. First, you lay out the process, everything from the customer application all the way through to monitoring and servicing. And then for each step of the process, you map two things one, the risks that can materialize, application fraud, income misstatement, sanction hits, wrong payment accounts, to give a few examples, and two, the controls that are supposed to manage them, kyc verification, sanction screening, income validation, maker checker approval, and so on. **[0:24:29] Laura Webanck:** Agents would monitor control health, third party status, and process performance on an ongoing basis, as opposed to what it looks like today, which might be once a quarter or once a year. And then what's more exciting and goes beyond what we have today is what happens when something breaks. For example, the income validation rule fails. In today's world, it might sit in the file, go undetected until months or even a year down the line. There's an audit or a loss, uh, where we go back and figure out, after lots of, uh, inquiries, that this is actually the the issue and the root cause, uh, of of the uh, of the loss. **[0:25:14] Laura Webanck:** In the twin, an agent would detect the failed control and block disbursement of the loan for all the affected applications. Agents would then recommend and trigger a set of actions, enhancing the income validation rule, taking a look at the data sources, pausing automatic approvals for some segments and pulling a human into the loop. You You can imagine, uh, from there, uh, and monitoring once you have an enhanced control in place. The outcome then is that we prevent all of these ineligible loans, uh, avoid the financial loss, um, and also avoid financial harm, um, customer impact, um, by early detecting and even predicting and acting on some of the challenges that can arise in in a process. **[0:26:04] Laura Webanck:** So that's one process now. Imagine that every process in the bank is mapped in such a way, and then they're all connected to each other. **[0:26:14] Sean Brown:** Got it? And and Laura, how does this impact the speed of response then against risks? If I can reference the analogy you made earlier, does the digital twin give you better brakes, meaning you can actually go faster? **[0:26:27] Laura Webanck:** So there's a couple of things that are exciting to us. One is you have much more transparency and a better understanding of the control framework, which should allow you to move faster. I think the other real benefit, though, is this idea of being real time and almost predictive. Um, I joke that, you know, I watched Minority Report 2020 years ago and I thought, man, that's not gonna be in my lifetime. But in a way, this, this is it. **[0:26:56] Laura Webanck:** This is being able to see, um, the issue coming down the pike and being able to do something about it quite early and not waiting until an event has materialized. Uh, and so that combined, combined with the greater transparency and the real time perspective, allows you to move a lot faster to get ahead of issues and to react more quickly. Um, when you, when you don't see them coming down the pike, **[0:27:22] Sean Brown:** And we won't need to rely on those little marbles coming down the, uh, down the tubes, like they did in the movie. **[0:27:28] Laura Webanck:** no, although that could be funny, **[0:27:32] Sean Brown:** Yeah, um, the other theme I'm hearing is this interconnection across different risks, processes, controls, and so on. Could you speak to that a little bit, please? **[0:27:40] Laura Webanck:** I mentioned before. But when you know, one of the things I think about a lot is the fact that you would never build, uh, non financial risk management. The way it's run today, where you have lots of, uh, disparate programs that have tenuous connection to each other. Just feed one output to the other, pretend they're connected by having a similar scale. But this is also an opportunity to move to something far more integrated. The example that we just talked about focused on the process and risk and controls and real time indicators, which is enormously helpful in and of itself. **[0:28:14] Laura Webanck:** But there are just a few elements of what you would potentially be able to build now along that process. Where do you have third party providers? How do you track whether or not they're meeting their SLAs? And do you have a view on your full exposure to a third party across all your core processes? Bjorn had shared earlier that there are actually very few institutions that are able to do this today. Now, take that across different risk stripes. **[0:28:40] Laura Webanck:** Where are you using models? Are they validated? When are they coming due? How do we use that to prioritize validation exercises? Um, are there upstream models that feed downstream models, and is that relevant context for even how they're validated? You can go stripe by stripe and think about the questions and, more importantly, the outcomes that you're optimizing for. And use that to help build this more integrated view. You'd want to ultimately layer in a view of products, of networks, uh, systems of applications. **[0:29:15] Laura Webanck:** Eventually, you could imagine having a jurisdictional or client type view, and this will be really the ultimate multi layer view of how the bank operates. And then how do you keep it live? You can monitor the results of, uh, the initiative in real time and keep your digital twin up to date in a in a much more symbiotic process, um, than what we have today. And ultimately, all of this unlocks an incredible opportunity to drive efficiency, whether it's in control, rationalization, process simplification, an opportunity to enhance resilience through scenario stress testing. **[0:29:56] Laura Webanck:** And then, of course, this this theme of real time view of risk. How do I enable proactive risk management? And how do I even use that to more dynamically allocate, uh, risk appetite and make it more than an annual exercise? **[0:30:11] Sean Brown:** All right, so Laura, can you also give us an example of how the digital twin enables this always on predictive mode of risk management? **[0:30:19] Laura Webanck:** The list is as long as your imagination will will stretch. Maybe I'll just start with a description of what the RCSA is, and then, you know, a little bit more technically, what this looks like. A risk and control self assessment is, uh, an exercise. It's usually done once a year, but ideally more often, where a business or function sits down, reflects on the key processes that they, um, undertake on a day to day basis. And ask, within reason, right? **[0:30:50] Laura Webanck:** What could go wrong? What are the what are the risks here? What are the outcomes I want? What could be indicators that I'm not gonna get the outcomes I want? And then how do we make sure that we have the right set of both predictive, uh, sorry, preventative and detective controls that make us safe? How? How do we operate this process safely? And so the idea of the RCSA is sort of a sense check. Do I have all of the right steps in place? **[0:31:20] Laura Webanck:** Do I have the right checks? Do I have, uh, the right controls that make me go back to the analogy that allow me to drive fast? Do I have all the right breaks? With the twin, the controls and the risks are re scored on a continuous basis and fed by live indicators, and so the view is always current. And so imagine you have a fresh RCSA every day. Scenario analysis and stress testing today takes weeks of manual analysis. **[0:31:50] Laura Webanck:** You have piecemeal data, maybe you do eight tests or tabletop exercises a year to know how you would perform in a stress scenario. With the twin, you can simulate the cascading impact of a vendor outage, a major cyber event, a regulatory change before it occurs. And actually be far more deliberate and data informed on where you want to further invest in resilience for your platform. Read across and root cause identification. Today, issues are handled one at a time, usually, uh, and read across usually involves getting a bunch of smart people in a room together and thinking about where an issue might lay. **[0:32:33] Laura Webanck:** With the twin, you can do almost instantaneous read across and identify every analogous exposure where you might have a similar risk. And you're able to do thematic analysis at a level where the cognitive load would be so big that humans would be hard pressed to do it without real tools. And maybe the last example I'll give is around concentration and nth party mapping. Today, this is manual, if you even have the data, and it misses lots of hidden single points of failure. **[0:33:08] Laura Webanck:** With a twin, these are surfaced. And in in one pilot with a client, we identified almost 200 concentration risks, and we identified one provider that was supporting more than thirty processes, many of them critical business processes. And you can imagine how that, um, institution walked away thinking, man, I'm gonna have to rethink my relationship with this organization, the controls in place, uh, and how I get confident that they're going to support me and what my fallbacks are. **[0:33:41] Laura Webanck:** There are many, many more examples than this. But the real notable takeaway is that every single one of these moves from reactive and point in time to proactive and dynamic. **[0:33:53] Sean Brown:** Okay, so Laura, just how prevalent is this take up of digital twins in the banking sector then? Currently? **[0:34:00] Laura Webanck:** It's worth noting that no financial institution that I'm aware of has built this yet. I actually think the digital twin is less of a proof point and more of an answer to the question, How do I think about an AI enabled, non financial risk transformation journey? What is what is my north star? If you have a clear idea of what you would like to achieve in terms of capabilities and then the level of integration that you wanna get to, you can chart the path to beginning to build towards this north star of a digital twin. **[0:34:39] Laura Webanck:** I think there's a number of institutions that are taking the disparate pieces of the NFR framework today and trying to identify them and getting some efficiency out of it. But it leaves a lot of value on the table. If you don't think also about how we get more integrated, how we get more dynamic, and how we push the the limits of the capabilities that we have today. Because there's so much more potential when we use some of these AI tools. **[0:35:10] Sean Brown:** So, Laura, this all sounds great, but it also begs the question, how do you get started on the journey? **[0:35:16] Laura Webanck:** So when we think about how do you get started with, you know, the twin really comes in in layers, a baseline ontology, uh, the other risk progra programs that connect into it, and then finally, the sort of agentic layer that sits on top. And so I'd ad advise anyone thinking about this to effectively begin with the RCSA, this process backbone that becomes the basis of the digital twin. You can stitch together the foundational elements that you already have, your process and product inventories, your risk and control inventories, technology, assets, third parties, et cetera. **[0:36:00] Laura Webanck:** And AI can help you generate some of these inventories from your various sources, help develop the process flows and map the risks and controls. And that initial output is the baseline view of how work actually gets done, what can go wrong, and and what manages the risk. From there, you then start to connect in some of the programs. You link in the control testing results, um, the issues and operational events, programs, audit findings, compliance obligations. And then you go into your third party risk, your cyber risk, your model risk, your operational resilience programs. **[0:36:37] Laura Webanck:** And it increases the richness of understanding of each of the risks and the relationship with each other and with the processes. And then the final boss in this game is the intelligence that you layer in. This is the agentic wrapper. This is how you detect emerging risks and changes, you simulate stress scenarios, you identify impacts, you actually start to recommend actions, um, and it learns over time and gets smarter. **[0:37:06] Sean Brown:** Got it? So the RCSA, or risk and control security assessment, is what guides the foundation of the digital twin. So what does an organization need to do to create this in terms of data? How good does the data need to be in order to get started? And and what role might AI play here? **[0:37:25] Laura Webanck:** The real takeaway here is the RCSA is an excellent place to start. It is the backbone, and it doesn't have to be perfect, it doesn't have to be mature for you to already get started. In fact, we often have discussions with institutions who tell us, This sounds incredible. This actually sounds like the stuff RIS risk practitioners dream of. Can you come back in two or three years when we're our data is ready and we've made enhancements to the framework? **[0:37:57] Laura Webanck:** And the first few times I was so t taken aback by the answer. Because AI can help expedite the journey, no matter what your starting point is. If you don't really have an RCSA, AI can either help develop the building blocks, um, the process and product hierarchy, the controls inventory, even the methodology itself, and actually help you get to a really good V1. And it does it in a way that's more objective and consistent and informed than a human would do it. **[0:38:30] Laura Webanck:** And then if you have an RCSA and you're like, we have one, it's still maturing, it's not up to snuff yet, right? There's an opportunity to enhance or rebuild some of the foundation. Gen AI can pressure test with a what we call a challenger RCSA, where you provide some of the raw information and agents, then build an RCSA sort of in parallel to what you have, and it compares it to what you have. And then you decide, you know, for the discrepancies, do I actually think that this is this is right? **[0:39:02] Laura Webanck:** is this better? How do I get to the best average answer? And then finally, there's folks that are quite happy with their RCSA. They've invested a ton of the into the programs, they find them quite mature today. And then this is the opportunity to move to real time insight. And agents can then enable an organization to shift to a dynamic RCSA, to have a a real time view of risk and control performance, insight on how external events, changes to the business impact, impact the bank. **[0:39:32] Laura Webanck:** And and and so on and so forth. And so we think that there's there's an opportunity for everyone. **[0:39:38] Sean Brown:** And to build on that, then what are the initial first steps that you walk clients through? If an organization doesn't already have an RCSA and wants to build one to enable this digital twin? **[0:39:49] Laura Webanck:** When we go into an organization that doesn't really have an RCSA yet, one of the first steps is to actually map out the organization and think about how do we think about the processes of, uh, of the organization? And you can imagine all all sorts of questions come up, which is how do I even get started? This feels like I have to send around an army of 200 people to go and and write on clipboards and follow people around. **[0:40:17] Laura Webanck:** Your procedures are generally a great starting point for building out what a process universe looks like. And depending on the industry that you're in, there's often a really great starting point from some of the industry associations. Because at the end of the day, we're not all that different in how we operate, at least particularly in banking. And and agents can actually start to take some of these references and some of your procedures and start to build these basic building blocks for you. **[0:40:45] Laura Webanck:** That then become the base of of your risk and control self assessment. **[0:40:50] Sean Brown:** And so then what kind of AI capability does one need to get started? Are there any specific models that you recommend? **[0:40:56] Laura Webanck:** Any of the established LLMs that everyone uses are perfectly fine to help get started on this journey. And there's probably a lot of different systems where your data sits today to actually even just build some of these agents. It's some Python code right now that sits on top of your other systems. You don't necessarily need a data lake, you don't need to build a new system. This is actually something that we can move a lot faster than a lot of traditional technology application, uh, sort of development, uh, which is which is really exciting to us. **[0:41:32] Sean Brown:** Indeed, so Anka and Bjorn, do you have anything to add to these points about how to get started on the journey? **[0:41:37] Anke Raufuss:** Maybe one thing to add when when you said you can start with policy documents, procedures to to basically inform the AI how things should work. I think that's a good starting point. Absolutely. I think the real benefit out of the human expertise and experience over years and years of doing these processes is to sit down with them, talk through and also distill some of that experience into code. That really gives you then the edge of accuracy. **[0:42:11] Anke Raufuss:** And and yeah, not just as it should be, but as it actually is being being operated. And the interesting thing when you sit down with a with a handful of uh, risk managers and talk through these processes, the variability, the variance, how they are actually doing that. The policy says you do it this way, but eventually everyone has their version of the policy. So distilling that and this process also facilitates a drive towards consistency of how you actually do things in the organization. **[0:42:43] Anke Raufuss:** Which is which is a benefit of its own, which leads to many of the other benefits. **[0:42:48] Björn Nilsson:** Yeah, if I, if I could add to that, I think the key is really to start, um, bottom up, taking one process and really looking at it end to end. So not doing a top down view of of the entire entire enterprise, but really selecting one high value process that is well understood. Also in the bank, like, like the lending process, um, or the client onboarding process. And then really taking that process to, um, to risk to control type of mapping and and then trying it out, uh, end to end. **[0:43:26] Björn Nilsson:** Like, how would a digital twin look for a specific process as well? That really also demonstrates the value of it before scaling it. **[0:43:36] Sean Brown:** Awesome, uh, Bjorn, Anka, Laura. Thank you so much for taking the time with us today to discuss digital twins and non financial risk management. Really appreciate it **[0:43:46] Björn Nilsson:** Thank you very much. **[0:43:46] Anke Raufuss:** Thank you. **[0:43:47] Laura Webanck:** thank you, Sean. **[0:43:48] Sean Brown:** and thank you to all of our listeners for joining us today. We hope you enjoyed the conversation and we welcome your feedback and ideas for future episodes. Just email us at itsr at mckinsey dot com. You can also share your ratings and reviews on any podcast player, with many thanks to all who've already done so. We really appreciate the comments and feedback we receive every week and encourage you to keep them coming. And if you enjoy this episode and you'd like to subscribe, we encourage you to follow our weekly series on any podcast player, where you can also access our entire library of more than 300 episodes. **[0:44:21] Sean Brown:** Finally, if you'd like to automatically receive our latest publications and insights, just visit our risk and resilience practice page at mckinsey dot com slash risk. You can also connect with us on LinkedIn, and we've included those links for you in the show notes. Thanks again for listening. We look forward to having you join us again next week inside the strategy room.