Why traditional risk training falls short in 2026

About Intuition

Since 1985, Intuition has partnered with leading financial institutions and Fortune 500 companies worldwide to build capability in complex, regulated environments. As an end-to-end strategic learning partner, we help organizations identify, design, and deliver the knowledge and skills their teams need to succeed. Our risk development programs focus on helping risk functions become trusted partners in decision making across the business.

***

The illusion of completeness

There’s no shortage of investment in risk training across financial institutions today, and in many respects that investment has never been more comprehensive. Teams are trained across the full spectrum of risk disciplines, from credit and market risk through to operational, liquidity, conduct, cyber, and increasingly ESG-related exposures, all supported by well-established frameworks, regulatory guidance, and an ever-expanding body of technical knowledge that defines how risk should be understood and managed within a modern institution.

On paper, this creates a picture of strength. Risk functions appear well-informed, well-structured, and aligned with both internal governance and external regulatory expectations. The assumption, quite naturally, is that this level of knowledge should translate into effective decision-making and, by extension, into a function that supports the broader direction of the business.

And yet, despite this, a familiar tension persists.

Many institutions still find that their risk functions aren’t consistently experienced as partners in decision-making, but rather as the point at which progress starts to slow, conversations become more cautious, and what initially looks like a commercial opportunity gradually turns into something more procedural.

It’s a perception that’s been around for some time, often described, not entirely unfairly, as risk acting as a kind of “deal prevention” function, and while most organizations would challenge that characterization, it remains a useful reflection of how risk can be experienced in practice.

Table of contents

• Knowledge is not the problem
• Where application breaks down
• The missing capability layer
• What this looks like in practice
• Rethinking how capability is built
• From control to contribution

Knowledge is not the problem

The difficulty, however, is that this perception doesn’t stem from a lack of technical knowledge. If anything, the opposite is true.

Risk professionals today are expected to operate with a deep understanding of how risk is identified, measured, and governed. They’re familiar with concepts like probability of default, loss given default, value at risk, stress testing, and scenario analysis, and they work within clearly defined frameworks that include risk appetite statements, model governance processes, and the three lines of defense. They’re also operating within an environment of increasing regulatory scrutiny, where requirements such as capital ratios, liquidity buffers, conduct rules, and ESG disclosures all need to be understood and applied with precision.

None of this is optional, and none of it is straightforward.

But what becomes increasingly clear, when you look at how risk functions operate in practice, is that knowledge alone doesn’t determine effectiveness.

The presence of frameworks, models, and regulatory understanding doesn’t automatically translate into the ability to navigate the kinds of decisions that financial institutions face on a daily basis, decisions that are rarely clean, rarely linear, and often shaped by incomplete information, competing priorities, and time pressure.

KPMG: The future of risk

The risk management market was valued at $15.40 billion in 2024 and is projected to reach $51.97 billion by 2033, growing at 14.6% CAGR.

Source

Where application breaks down

It’s in these situations that the limits of traditional risk training start to appear.

While risk can be defined in structured terms, it’s rarely encountered in structured ways. A model that performs well under historical conditions may prove unreliable when market dynamics shift, particularly when the assumption that past data can predict future outcomes no longer holds. Data that appears robust at a system level may reveal gaps or inconsistencies when you look at it more closely, raising questions about the reliability of the metrics being used to inform decisions. Regulatory requirements, particularly in areas like ESG, evolve quickly, often requiring interpretation and prioritization rather than simple implementation.

At the same time, the flow of information within organizations isn’t always as seamless as frameworks suggest.

Risk signals generated at an operational level don’t always travel effectively upward, and when they do, they’re not always communicated in a way that allows senior decision-makers to act on them with confidence.

So the result isn’t necessarily a failure of knowledge, but more a failure of application.

What does a future-ready financial risk function look like?

The missing capability layer

And it’s here, in that space between knowledge and application, that the real challenge starts to emerge.

Traditional risk training is, by design, focused on the “what”.

What is credit risk, what is operational risk, what are the relevant models, what are the regulatory requirements, what are the policies that govern behavior.

All of this is essential, and without it the risk function wouldn’t have the foundation it needs to operate at all.

What it doesn’t always address, though, is the “how”.

How do you approach a situation where the available data is incomplete or unreliable? How do you challenge the assumptions embedded within a model that appears, on the surface, to be functioning correctly? How do you interpret a regulatory requirement in a way that aligns with both compliance expectations and commercial realities? And how do you communicate risk in a way that allows the business to understand not just what the exposure is, but what can actually be done about it?

These aren’t purely technical questions. They’re questions of judgment, interpretation, and communication.

Allianz on climate risk and the future of insurability

What this looks like in practice

Take model risk as an example. It’s well understood that models are built on assumptions, and that those assumptions won’t always hold. Recent years have shown this quite clearly, where models calibrated on historical data struggled to adapt to new market conditions. The technical knowledge required to understand how a model is constructed is important, but it’s not enough if the underlying assumptions aren’t questioned, or if alternative approaches aren’t considered when conditions change.

Or take data quality, which remains an ongoing challenge in many institutions. Systems can be fragmented, data lineage can be unclear, and inputs can be incomplete or inconsistent. Understanding how data feeds into risk metrics is one thing, but identifying when that data is no longer reliable, and actually doing something about it, is something else entirely.

You see a similar pattern in how risk is communicated. Risk frameworks often assume a “bottom-up” flow of information, where issues identified at a lower level are escalated and addressed at a senior level. In practice, though, this depends heavily on how well that information is translated. Technical risk metrics, if they’re not framed in business terms, can fail to resonate with decision-makers, which limits their impact even when the underlying analysis is sound.

In each of these cases, the limitation isn’t knowledge. It’s the absence of the capabilities needed to apply that knowledge in context.

When financial systems fail: Key lessons for risk leaders

Rethinking how capability is built

This is why many institutions are starting to rethink how risk capability is developed.

Rather than focusing exclusively on expanding technical training, there’s a growing recognition that capability development also needs to address how risk professionals think, how they approach problems, and how they engage with the wider business.

Structured problem solving, critical thinking, and the ability to communicate complex ideas clearly are no longer peripheral skills, they’re central to how risk functions operate effectively.

This shift has real implications for how learning is designed.

It means moving beyond content that’s purely descriptive and toward learning that’s applied, contextual, and grounded in real scenarios. It means creating opportunities for risk professionals to work through ambiguity, to challenge assumptions, and to explore how different decisions might play out under different conditions. And it means reinforcing the connection between technical knowledge and business outcomes, so that risk isn’t understood in isolation, but as part of the broader decision-making process.

Why risk teams are still seen as growth blockers

From control to contribution

For organizations, the implications are significant.

Because when these capabilities begin to develop, the role of the risk function starts to change, often in subtle but important ways. Conversations that might previously have defaulted to escalation become more focused on resolution. Regulatory requirements are interpreted in a way that aligns more closely with strategy. Risk insights are communicated in terms that support decision-making rather than constrain it.

Over time, that begins to shift perception.

Risk is no longer experienced primarily as a control mechanism, but as a function that helps the organization navigate complexity with greater clarity.

It’s still grounded in the same frameworks, the same models, and the same regulatory expectations, but the way it operates within those structures becomes more adaptive, more engaged, and ultimately more aligned with the needs of the business.

And in a financial environment that continues to grow in complexity, where uncertainty isn’t the exception but the norm, that shift from knowledge to capability may well prove to be one of the defining factors in how effectively institutions manage risk in the years ahead.