Companies urged to build AI into risk management, not bolt it on

The ability of artificial intelligence to process information at unprecedented speed and scale is becoming essential to how companies manage increasingly complex risks, according to a new report from advisory firm EY.

EY said many risk functions remained in a “wait-and-see” mode over AI adoption, despite the technology’s rapidly improving capabilities making such an approach increasingly difficult to sustain.

The firm’s third Global Risk Transformation Study argues that companies will need to move beyond simply applying AI to existing processes and instead redesign risk management around what AI can do best.

Kapish Vanvaria, EY Global Risk Consulting Leader, said the speed, scale and insight offered by AI were becoming indispensable as companies sought to manage a rapidly changing risk environment.

The report describes the current risk landscape as NAVI, meaning nonlinear, accelerated, volatile and interconnected, with companies increasingly exposed to risks that can emerge suddenly and trigger wider consequences.

EY said the challenge had become particularly apparent as risk leaders faced the Iran War and subsequent closure of the Strait of Hormuz, alongside the emergence of frontier AI models capable of identifying cyber vulnerabilities on a massive scale.

The report does not offer specific responses to either crisis, arguing instead that the more important question is whether companies remain trapped in a reactive approach to risk.

“By the time you read this, these crises may well have faded, but they will almost certainly have been suppanted by other systemic shocks,” EY said.

The firm argued that the nature of resilience itself must change, with companies needing to move from simply protecting business continuity towards using risk management to support strategic growth.

That means being able to identify and respond to rapidly changing developments in real time, model vast numbers of risks and scenarios, and reduce the likelihood of companies being caught unprepared by unexpected events and cascading risks.

AI can provide three capabilities that EY considers particularly important.

Its speed can replace slow, periodic manual processes with rapid and automated responses, while its scale allows companies to assess variables and scenarios far beyond human capacity.

Its analytical insight can also help companies deal with complex risks while reducing the impact of human biases and limitations, including confirmation bias, cognitive overload and decision paralysis.

“The post-pandemic risk environment has become increasingly complex,” said Bill Diaz, CEO of Archer.

“Risks now show up everywhere, at any time, often triggering chain reactions. The pace is faster, the effects larger. AI is vital for managing risk in this environment; it’s critical for handling today’s increased volume and complexity, as well as for responding to risks in real time,” he said.

However, EY warned that simply introducing AI into existing processes would not necessarily deliver its full value.

Many companies have initially focused on relatively straightforward automation, including the use of governance, risk and compliance platforms, which can standardise processes, improve coordination and reduce manual work.

EY said this incremental approach remained useful because it could provide proof of concept, generate near-term returns and require less disruption to existing operating structures.

But the biggest gains are likely to come from fundamentally redesigning processes, rather than making existing ones more efficient.

“Most companies have felt compelled to adopt AI,” said Raul Villar Jr, CEO of Optro.

“Every board and C-suite has been focused on how they can leverage this technology to their benefit. And so everyone’s invested in AI, but most have yet to see the return they were expecting on those investments,” he said.

“Our acquisition of Midship, an agentic AI platform, was driven by a desire to accelerate value realisation and a conviction that the future of GRC isn’t faster audits, it’s fundamentally different ones,” Villar said.

Dan Diasio, EY Global Consulting AI Leader, said leading companies were increasingly treating AI as a foundation for redesign rather than an addition to existing processes.

“Leading companies are moving away from making AI accretive to a process, and are instead looking at using AI to fundamentally reinvent processes,” he said.

“They are transforming ways of working. This means challenging whether a particular process is still needed, and what the future, AI-native process should instead be. The real value realisation opportunity is not from using AI as a bolt-on but making AI built-in to processes and functions,” Diasio said.

EY said this “built-in” approach could allow companies to rethink entire functions and processes while making their AI strategies more adaptable to future developments.

The firm acknowledged that the rapid evolution of AI itself creates uncertainty, with new models and capabilities capable of emerging unexpectedly and potentially overturning existing assumptions and adoption plans.

Nevertheless, it said companies could move ahead with AI that was future-ready, rather than waiting for the technology to mature before acting.

The report further stated that companies which combine AI with appropriate oversight and the ability to monitor how AI agents operate could gain an advantage during future crises by identifying impacts earlier and responding faster than competitors.