External fraud has entered the ORX Top 5 operational risks table, above business continuity and regulatory compliance. AI has been cited as key to driving this increase, as it fuels more sophisticated and harder to detect fraud schemes, successful at bypassing controls.

The findings were published in a report from ORX, the world’s largest operational risk association which works with over 125 banks and insurers globally.  

According to the report – Top Risk Review – the top four rankings of Information Security (incl. Cyber), Third Party, Technology and Data Management have remained unchanged since May 2022.  All four top risks reflect continuing digital transformation in financial institutions, which is heavily impacting these scores.

Figure 1: The top five ranked risks from the last four Top Risk Review surveys

Steve Bishop, ORX's Director of Research and Information explains:

“There appears to be a race to implement artificial intelligence for ‘good’ and ‘bad’. Although the firms we work with do not appear to be suffering major cyber breaches, criminals continue to use AI in an attempt to circumvent security controls. This threat results in increased pressure to have robust prevention and detection measures in place.”

“Now more than ever it is crucial to keep defences robust in light of new and emerging technology.”

Information Security (incl. Cyber) continues to dominate first position

Despite Information Security topping the survey for the last four years, indications this year are that it is now being managed more effectively. Regardless, threat levels remain high with awareness of the potential impact of just one successful attack to an organisation’s operational resilience.

External Fraud risk enters the top five for the first time in two years

External Fraud now enters the top five for the first time since November 2021, replacing Regulatory Compliance. Survey participants consistently called out an increasing frequency of fraud and scam events, in particular those targeting customers, as the key reason for scoring the risk highly. Economic pressures and the growing perception of fraud's increasing profitability were also key factors.

Rapid development of AI is creating both opportunities and threats

According to the survey, the use of AI is lowering the barriers to entry, resulting in increasingly difficult to detect fraud methodologies. Banks and Insurers expressed concern around upcoming or potential changing customer reimbursement rules and regulations in some regions/jurisdictions.

The report revealed a sense of urgency in adopting AI, seeing it as part of the methodologies of fraudsters and the decision-making and critical business functions of competitors. However, respondents acknowledged that the use of AI comes with a range of associated risks, from compliance challenges to validation of AI models.

Third parties are a potential vulnerability

Reliance on third parties to perform business critical tasks and processes continues to place significant elements of control environments and risk exposure areas outside the direct control of organisations themselves. Concerns around the robustness of third parties’ risk management practices, combined with a strong regulatory focus on third party-related risks, have reinforced Third Party risk’s position as the second-highest ranked risk with a growing gap down to third place.