320. The digital twin: Reimagining non-financial risk management

0:01Björn Nilsson: It's worth noting that no financial institution that I'm aware of has built this yet. I actually think the digital twin is less of a proof point and more of an answer to the question, how do I think about an AI-enabled non-financial risk transformation journey? What is my North Star?

0:25Anke Raufuss: For McKinsey & Company, I'm Sean Brown, and welcome to Inside the Strategy Room. The complexity and pace of non-financial risk today is expanding and accelerating. Incidents are cascading in hours rather than days or weeks, and the fallout is now often more wide-ranging. Yet despite increasing controls, investments, and headcount, risk outcomes are not improving. Can an AI-enabled digital twin help organizations reimagine their non-financial risk management? And if so, what are some of the first steps risk leaders should take? Today, we're joined by three of our risk and resilience experts to unpack these digital developments.

1:07Anke Raufuss: Anka Raufis is a senior partner in our Sydney office and a key leader of our Asia risk and resilience practice. She's also the global leader of our work in non-financial and market risk. Bjorn Nilsson is a partner in our Stockholm office and a leader in our global non-financial risk service line. And Laura Weebank is a partner in our New York office and leads our risk and control service line in the Americas. Welcome, everyone. Anka, maybe you could set the scene for us. Non-financial risk is a topic that's getting a lot of media attention right now, and it's a top-of-mind concern for many business leaders.

1:43Anke Raufuss: What has changed in the risk management landscape recently to warrant this focus, and why the sense of urgency?

1:50Laura Webanck: Thank you. Indeed, the risk management landscape is changing. And in particular, in a technology, digital, AI-enabled world, we need to be faster in the way we manage non-financial risk. Maybe let me tell you a little story from this week's newspaper that made me laugh initially, but then also made me a little bit nervous. Someone in Australia, a very innovative bunch of people, was tired of racing to book a spot in a popular Pilates class. So they asked an AI agent to handle it. And the AI agent actually succeeded brilliantly. It found a vulnerability in the gym's booking system, manipulated the wait list and canceled someone else's reservation to move its owner up the queue.

2:37Laura Webanck: And when asked why, the agent's response was essentially, the system let me do it. So I did it. You're welcome. So now, Pilates, that's low stakes. But if you close your eyes and imagine some same behavior happening with an AI agent in a bank, that's obviously more malicious and really not helpful. Think about a lending process where suddenly there's someone bypassing some maker-checker controls. But the world in which we're entering has increased non-financial risk and accelerated non-financial risk.

3:10Anke Raufuss: That story really illustrates for me how an innocent request by a user of an agent could still increase the threat landscape. So with these accelerating challenges in managing non-financial risks, how successfully are you seeing organizations respond? Maybe let me start with some uncomfortable truth about where we are today.

3:33Laura Webanck: We've invested massively in non-financial risk and the outcomes have not improved. Our global risk productivity benchmark tells a stark story. Operational risk FTEs grew approximately 11 % per year between 2020 and 23, faster than virtually any other risk type. And teams responsible for IT risk, third-party risk, data risk, cyber risk, grew 40 % to 130 % in just three years. Similarly, capital requirements for operational risk rose 50 % in Europe over two years. And the result, so what's the impact of that? Only 4 % of institutions in our flash survey report say that operational risk exceeds its productivity target.

4:19Laura Webanck: So the impact of this increase in resources does not show, this is not for lack of effort or good intentions. There is really a lot of investment, a lot of positive movements happening, but they're still also working towards the tide of 20 ,000 controls and How do we test all of them? And the positive thing is, this is all possible to improve with the help of AI.

4:49Anke Raufuss: And I'm really looking forward to talking more about those improvements. But before we do, Anka, I understand this is coming to the foreign banking. And it would be great if you could also explain how the concept of non-financial risk extends across other sectors. What does it look like, for example, in more physical industries like mining? Yes, absolutely.

5:10Laura Webanck: So the use of AI or also of agents or of digital twins, we've seen it in heavy, high volume processes in very predictable processes like in mining your supply chain management, you can really map it out the whole process throughout and can nearly determine and predict what is what is going to happen. and also what needs to happen in order for the supply being very smooth. So we've learned a lot from that. We learn a lot from the aviation industry, for example, regarding their safety culture. So more the behavioral aspects that we can draw on there, that everyone has it in their DNA, how to walk down a stairs.

5:56Laura Webanck: I'm always amazed by seeing that everyone directly grips the handrail. It's just part of the DNA. So there's both structural elements and technical elements that we can learn and adopt for banking, but also some of the behavioral practices.

6:15Anke Raufuss: Thanks, Anka. And Laura, any thoughts you'd like to add here? What kind of opportunities, for example, are there for the banking industry to rethink their approach to managing non-financial risks?

6:25Björn Nilsson: Maybe I'll share two reflections. One is the idea that in a lot of these physical industries, there is less the concept of compliance following the rules and more a culture of safety and people actually feeling empowered to use judgment. And I think there's this idea of how do we how do we bring that more into our professional services industries? And my other reflection is a lot of the way that we do risk management in non-financial risk today, and I think it's evidenced by this, no matter how many people we throw at the problem, it doesn't necessarily get better. It's built, it's been built piecemeal over a long period of time.

7:11Björn Nilsson: And if you were to start with a fresh piece of paper, you would never build it the way it is actually operated today. And so there's really this opportunity to step back and say, what are the outcomes that we really want to achieve? And how can we build different and better now that we have this moment of inflection with AI?

7:34Anke Raufuss: Thanks, Laura. And Anka, maybe you could talk a little more about the impetus to, as Laura suggests, reimagine the approach to non-financial risk in this AI moment. Maybe you could share some examples that could help bring this to life.

7:47Laura Webanck: When something does go wrong today, it really goes wrong fast and big. And the examples have been on all of our minds and made us rethink and test our own controls in the respective areas. If you think about the widely deployed endpoint security tool crashing and eight and a half million devices globally not getting the right updates in time and causing an estimated five, more than five billion damage to Fortune 500 companies. It's just the scale of that impact in a very connected world, huge. Or as another example, a bank's non-essential IT activities were being paused for six months after a series of system failures.

8:36Laura Webanck: I think there's a common pattern around speed and interconnectivity and transparency. When a signal becomes a serious incident in hours, not weeks, that's a challenge. A failure in one vendor or one system can cascade across business lines or geographies or legal entities. And most institutions generally do not have full visibility of their full exposure. That's exactly why a good answer, the answer can't be just more controls, more people. The problem is really structural and we need to solve it in a more structural way. And that's the why behind the digital twin.

9:16Anke Raufuss: Thanks. And this might be a good moment to define what a digital twin really is. Anka, maybe you could explain that for us.

9:22Laura Webanck: So digital twin is basically just a replica of your existing operations. and we've been mapping processes and maintaining them live and up to date. But it is a long process, a long business activities that risks arise and where also you need to add controls to a business process. So it's basically a replica of reality in which you can foresee potential issues in the future where you have a normal baseline of how it should work and can think about deviations from the baseline just as they don't hopefully occur or which helps you prevent in real life.

10:12Anke Raufuss: And you and Laura have both made the point that progress on non-financial risk targets hasn't necessarily followed an increase in resources. So if headcount isn't the lever, how does the digital twin help close that gap? And what is the productivity metric that one might want to look at here?

10:29Laura Webanck: It's a very good question. And I do think everyone is grappling with how do I demonstrate the value of managing non-financial risk, which technically is often phrased as, yeah, protecting from downside. That's one angle to it. The good old counting losses is a very lagging indicator for it. But ideally, you have more leading indicators that you really can demonstrate that you've identified early some of the potential issues that could have materialized in an incident. So some of the non-materialized incidents and having track on that.

11:08Björn Nilsson: If I could add to that, I also think that there's some wisdom in the saying that brakes are the controls on your car that let you go fast. And as we look at how AI, not from a risk management perspective, but just from a business perspective, will start allowing organizations to move much faster in developing updates, in releasing code, in developing products, And in competing in a landscape where others are also moving quite fast, having a real-time view, having more confidence in your control environment is going to allow you to more confidently compete at the speed of the market. And so it becomes really critical to the business and not just to risk management.

12:01Anke Raufuss: And Bjorn, anything you'd like to add here?

12:03Laura Webanck: Yeah, I think what is making this possible now that you could build basically a replica of the bank with the different processes, with the different risk, the different controls, and you can do simulation before an event actually happens. That really, we are now at the stage where the technology can really enable us to do that and therefore also be more proactive in the risk management and test things before the failures actually happen. So I'm very confident that the future of non-financial risk management and how we think about risk will be materially different than the still rather manual processes that we're relying on today.

12:46Anke Raufuss: Super. And Bjorn, today many banks are operating with supplier and vendor networks that are becoming increasingly complex. So I was hoping maybe you could share an example of how this complexity and the speed of non-financial risk exposure is actually demanding a different approach than it was, say, five to 10 years ago.

13:05Laura Webanck: Yes. So one dimension that makes non-financial risk fundamentally different today is, as you say, the dependency of the banking sector on complex vendor systems. Because it's really reshaping the risk picture across every institution that we work with. But if you consider five to 10 years ago, third-party risk meant that you had a due diligence questionnaire that you did for your top 40 to 50 vendors. But today, those 40 to 50 vendors that you have, they themselves also depend on further layers of providers and third parties. So cloud, shared data infrastructure, communications providers, different models.

13:50Laura Webanck: So the map in the sector has really become very entangled. And what we often then observe is that banks can name their third parties, so the direct third parties. Most can also name their fourth parties. But very few can actually take a single critical provider and identify every process across the bank which depend on that single provider. so also looking at some of the numbers from our recent CRO flash survey just to make this a bit more concrete only a quarter of the banks can map end-to-end their fourth and fifth parties so only a quarter of the banks six out of ten they also acknowledge that they have very limited visibility in embedding upstream or or software so how does actually software that are that are vendors or third-party providers use?

14:48Laura Webanck: How does that affect us? And even where they then collect the fourth-party information, only a quarter can translate that into actual management decisions. So, I mean, the dynamics here is that there's first more interdependencies. So we've seen also that individual providers present more than 30 processes across a single bank. And there's no single owner in the bank that has a view of all of the different interdependencies. And then second to interdependencies, then speed. So what used to be a slow moving incident chain is now really a very quick escalation. So a vendor issue to an escalation to different disclosures that you need to provide within hours rather than days.

15:40Laura Webanck: So the matters really, really escalate quickly now today as well.

15:45Anke Raufuss: Right. And so how is this kind of risk complexity being managed in industries other than banking? Anka mentioned, for example, there are other industries that have already been doing this for some time. Sure.

15:58Laura Webanck: So, I mean, if we step outside of banking, as we were speaking about, other industries have been managing this systemic interdependent risks under uncertainty. for a long period of time. And there are, I would say, five patterns from them that we think are also directly relevant for how we can reimagine our non-financial risk also in the financial sector. The first one that I would highlight is taking an example from e-commerce sector. They tend to automate routine work, not only because it's cost-efficient, but also where you have repetitive work for humans, there's also typically weaknesses in the control process.

16:45Laura Webanck: So errors occur when people get tired. And the lessons for us is that many controls are still manual, maybe because they've always been manual, but not because manual is a good thing. So looking for a way to automate the routine work is a key learning from other industries. The second thing I would call out is to really embed a genuine risk culture that also puts focus on peer accountability. So in energy sector, where they're operating major facilities, oil rigs, there's an expectation that every employee holds others accountable also to safety standards. Then thirdly, there are industries that are better at sharing also risk signals with their peers than the banking sector.

17:41Laura Webanck: So airlines, they, for instance, contribute incident data to a common exchange. So every operator then benefits also from each other's near misses. In banking, we do this to a limited degree, though, but it's primarily in regulatory-led exercises, but it's not at the same scale and velocity as we see in other industries. I think the fourth one is then also to measure the outcomes rather than the actual compliance to procedures. So that quality, for instance, is measured in terms of patient outcomes in the healthcare industry and whether the treatment actually worked is not whether a particular checklist was followed fully a clinical checklist.

18:29Laura Webanck: And then maybe the last one, if we think about the advanced industries like nuclear utilities, they tend to build also digital instances of their physical infrastructure so that they can also model how a single failure then propagates before it occurs in the real world. So that is also a capability that we need to deploy more in banking.

18:53Anke Raufuss: And how is the technology itself evolving to enable this? Does AI offer a systematic approach to the mapping and risk assessments that we were discussing previously? And how does this all lead us to the digital twin?

19:07Laura Webanck: Yes, there's the fundamental basis for running non-financial risk management differently than before. So, I mean, if you were to ask a year ago, no, maybe not a year ago, but three to five years ago, whether we can make risk assessments dynamic, make them real time. Most would have said no. I mean, you couldn't stitch the data that you need for it fully together. You couldn't run the actual computations and simulations behind it. You didn't really have the capability also to take all this data in, make sure that you You can also convert signals or read signals out of the data and do recommendations based on it.

19:50Laura Webanck: So I think these constraints have now eased significantly. I think there's four major shifts that we're now seeing. So, I mean, first is that we're moving them from manual processes to automated actions and then leaving the human effort to focus on the real risks that matter. So genuine judgment calls where those need to be made. Second shift that we're seeing is that we are moving more from this point in time assessment to more dynamic decisions. And then thirdly, we move them from backward looking to more proactive management. And then lastly, we're shifting also from more sort of judgment-based to objective risk management because we're not sort of replacing expert judgment with a machine, but judgment is made then more essential for where the actual tail risks are.

20:51Laura Webanck: So we can sort of expand the evidence base and reduce variance in routine decisions by letting a machine take the really routine decisions that are of low risk. If you put all of these four together, I think you start to see sort of something that looks like a digital twin of a bank. So really like a live connected model of different processes, risks, controls, third parties, with then agents actually monitoring and acting on top of it.

21:25Anke Raufuss: So are there any examples of full digital twins yet? Or is this still being evolved and constructed? Yes.

21:34Laura Webanck: So, I mean, there's multiple banks that are needed in order to run this today. So, I mean, I would say that there's a full enterprise twin is not yet in production anywhere. So we should be transparent about that. But there are banks that are running multiple of the components that are needed for a digital twin today. So like agentic RCSA pilots, third-party concentration mapping, live control monitoring, looking into origination and payments and monitoring. So I think there's multiple bits and pieces of a digital twin. So basically a replica of the bank in a digital version where you can also simulate how changes to processes and risks actually then impact your risk profile.

22:29Anke Raufuss: Thanks, Bjorn. And Laura, I know our listeners would be keen to hear more about what this looks like in practice. Perhaps you could give us a little bit more detail on how a digital twin works in a banking context. All right.

22:42Björn Nilsson: So let's go deeper into the idea of a digital twin. As we've mentioned, this isn't a novel concept. Factories have been doing this for 20 or so years. In a factory setting, a digital twin is a virtual representation of the production line where it's hooked up to live sensors that track anything from temperature, electricity usage, quality output. And you can immediately see the value in understanding how things are operating in real time. In factories, what you can do is predictive maintenance. You can spot where a piece might be wearing out. You can identify bottlenecks to figure out where delays are coming from.

23:20Björn Nilsson: You can also test changes and new layouts before making updates. So we'll explore the concept for banking, but the concept can apply for any number of industries and is already in practice in a number of them. Imagine a bank's processes, risks, and controls represented life with agents continuously obviously, updating and acting the moment a control fails without a human having to initiate a check and do a bunch of analysis. And we can start with a retail loan origination example to make this concrete. First, you lay out the process, everything from the customer application all the way through to monitoring and servicing.

24:04Björn Nilsson: And then for each step of the process, you map two things. One, the risks that can materialize, application fraud, income misstatement, sanction hits, wrong payment accounts, to give a few examples. And two, the controls that are supposed to manage them, KYC verification, sanction screening, income validation, make or check or approval, and so on. Agents would monitor, control health, third-party status and process performance on an ongoing basis, as opposed to what it looks like today, which might be once a quarter or once a year. And then what's more exciting and goes beyond what we have today is what happens when something breaks?

24:48Björn Nilsson: For example, the income validation rule fails. In today's world, it might sit in the file, go undetected until months or even a year down the line, there's an audit or a loss where we go back and figure out after lots of inquiries that this is actually the issue and the root cause of the loss. In the twin, an agent would detect the failed control and block disbursement of the loan for all the affected applications. Agents would then recommend and trigger a set of actions, enhancing the income validation rule, taking a look at the data sources, pausing automatic approvals for some segments and pulling a human into the loop.

25:36Björn Nilsson: You can imagine from there and monitoring once you have an enhanced control in place. The outcome then is that we prevent all of these ineligible loans, avoid the financial loss, and also avoid financial harm, customer impact. by early detecting and even predicting and acting on some of the challenges that can arise in a process. So that's one process. Now imagine that every process in the bank is mapped in such a way and then they're all connected to each other. Got it.

26:14Anke Raufuss: And Laura, how does this impact the speed of response then against risks? If I can reference the analogy you made earlier, does the digital twin give you better breaks, meaning you can actually go faster?

26:26Björn Nilsson: So there's a couple of things that are exciting to us. One is you have much more transparency and a better understanding of the control framework, which should allow you to move faster. I think the other real benefit, though, is this idea of being real-time and almost predictive. I joke that, you know, I watched Minority Report 20 years ago and I thought, man, that's not going to be in my lifetime. But in a way, this is it. This is being able to see the issue coming down the pike and being able to do something about it quite early and not waiting until an event has materialized. materialized. And so that combined with the greater transparency and the real-time perspective allows you to move a lot faster, to get ahead of issues, and to react more quickly when you don't see them coming down the pike.

27:22Anke Raufuss: And we won't need to rely on those little marbles coming down the tubes like they did in the movie. No.

27:30Björn Nilsson: Although that could be funny.

27:32Anke Raufuss: The other theme I'm hearing is this interconnection across different risks, processes, controls, and so on. Could you speak to that a little bit, please?

27:40Björn Nilsson: I mentioned before, but one of the things I think about a lot is the fact that you would never build non-financial risk management the way it's run today, where you have lots of disparate programs that have tenuous connection to each other, just feed one output to the other, pretend they're connected by having a similar scale. But this is also an opportunity to move to something far more integrated. The example that we just talked about focused on the process and risk and controls and real-time indicators, which is enormously helpful in and of itself. But there are just a few elements of what you would potentially be able to build.

28:18Björn Nilsson: Now, along that process, where do you have third-party providers? How do you track whether or not they're meeting their SLAs? And do you have a view on your full exposure to a third party across all your core processes? Bjorn had shared earlier that there are actually very few institutions that are able to do this today. Now, take that across different risk stripes. Where are you using models? Are they validated? When are they coming due? How do we use that to prioritize validation exercises? Are there upstream models that feed downstream models? And is that relevant context for even how they're validated?

28:57Björn Nilsson: You can go stripe by stripe and think about the questions and more importantly, the outcomes that you're optimizing for, and use that to help build this more integrated view. You'd want to ultimately layer in a view of products, of networks, systems, of applications. Eventually, you could imagine having a jurisdictional or a client-type view. And this will be really the ultimate multi-layer view of how the bank operates. And then how do you keep it live? You can monitor the results of the initiative in real time and keep your digital twin up to date in a much more symbiotic process than what we have today.

29:40Björn Nilsson: And ultimately, all of this unlocks an incredible opportunity to drive efficiency, whether it's in control rationalization, process simplification, an opportunity to enhance resilience through scenario stress testing. And then, of course, this theme of real-time view of risk. How do I enable proactive risk management? And how do I even use that to more dynamically allocate risk appetite and make it more than an annual exercise? All right.

30:11Anke Raufuss: So, Laura, can you also give us an example of how the digital twin enables this always on predictive mode of risk management?

30:19Björn Nilsson: The list is as long as your imagination will stretch. Maybe I'll just start with a description of what the RCSA is and then a little bit more technically what this looks like. A risk and control self-assessment is an exercise that's usually done once a year, but ideally more often, where a business or function sits down, reflects on the key processes that they undertake on a day-to-day basis, and ask within reason, right, what could go wrong? What are the risks here? What are the outcomes I want? What could be indicators that I'm not going to get the outcomes I want? And then how do we make sure that we have the right set of both preventative and detective controls that make us safe?

31:09Björn Nilsson: How do we operate this process safely? And so the idea of the RCSA is sort of a sense check. Do I have all of the right steps in place? Do I have the right checks? Do I have the right controls that make me go back to the analogy that allow me to drive fast? Do I have all the right brakes? With the twin, the controls and the risks are rescored on a continuous basis and fed by live indicators. And so the view is always current. And so imagine you have a fresh RCSA every day. Scenario analysis and stress testing. Today, it takes weeks of manual analysis. you have piecemeal data, maybe you do eight tests or tabletop exercises a year to know how you would perform in a stress scenario.

31:59Björn Nilsson: With the twin, you can simulate the cascading impact of a vendor outage, a major cyber event, a regulatory change before it occurs, and actually be far more deliberate and data informed on where you want to further invest in resilience for your platform. Read across at root cause identification. Today, issues are handled one at a time, usually. And read across usually involves getting a bunch of smart people in a room together and thinking about where an issue might lay. With the twin, you can do almost instantaneous read across and identify every analogous exposure where you might have a similar risk.

32:44Björn Nilsson: And you're able to do thematic analysis at a level where the cognitive load would be so big that humans would be hard pressed to do it without real tools. And maybe the last example I'll give is around concentration and nth party mapping. Today, this is manual if you even have the data, and it misses lots of hidden single points of failure. With a twin, these are surfaced. And in one pilot with a client, we identified almost 200 concentration risks. And we identified one provider that was supporting more than 30 processes, many of them critical business processes. And you can imagine how that institution walked away thinking, man, I'm going to have to rethink my relationship with this organization, the controls in place, and how I get confident that they're going to support me and what my fallbacks are.

33:41Björn Nilsson: There are many, many more examples than this. But the real notable takeaway is that every single one of these moves from reactive and point in time to proactive and dynamic.

33:53Anke Raufuss: Okay, so Laura, just how prevalent is this take-up of digital twins in the banking sector then currently?

33:59Björn Nilsson: It's worth noting that no financial institution that I'm aware of has built this yet. I actually think the digital twin is less of a proof point and more of an answer to the question, how do I think about an AI-enabled non-financial risk transformation journey? what is my North Star? If you have a clear idea of what you would like to achieve in terms of capabilities and then the level of integration that you want to get to, you can chart the path to beginning to build towards this North Star of a digital twin. I think there's a number of institutions that are taking the disparate pieces of the NFR framework today and trying to identify them and getting some efficiency out of it.

34:50Björn Nilsson: But it leaves a lot of value on the table if you don't think also about how we get more integrated, how we get more dynamic, and how we push the limits of the capabilities that we have today because there's so much more potential when we use some of these AI tools.

35:10Anke Raufuss: So, Laura, this all sounds great, but it also begs the question, how do you get started on the journey?

35:15Björn Nilsson: So when we think about how do you get started with, you know, the twin really comes in layers, a baseline, ontology, the other risk programs that connect into it, and then finally the sort of agentic layer that sits on top. And so I advise anyone thinking about this to effectively begin with the RCSA, this process backbone that becomes the basis of the digital twin. You can stitch together the foundational elements that you already have, your process and product inventories, your risk and control inventories, technology, assets, third parties, etc. etc. And AI can help you generate some of these inventories from your various sources, help develop the process flows and map the risks and controls.

36:09Björn Nilsson: And that initial output is the baseline view of how work actually gets done, what can go wrong, and what manages the risk. From there, you then start to connect in some of the programs. You link in the control testing results, the issues and operational events programs, audit findings, compliance obligations. And then you go into your third party risk, your cyber risk, your model risk, your operational resilience programs, and it increases the richness of understanding of each of the risks and the relationship with each other and with the processes. And then the final boss in this game is the intelligence that you layer in.

36:50Björn Nilsson: This is the agentic wrapper. This is how you detect emerging risks and changes. You simulate stress scenarios. You identify impacts. You actually start to recommend actions. And it learns over time and gets smarter.

37:06Anke Raufuss: Got it. So the RCSA or risk and control security assessment is what guides the foundation of the digital twin. So what does an organization need to do to create this in terms of data? How good does the data need to be in order to get started? And what role might AI play here? The real takeaway here is that RCSA is an excellent place to start.

37:31Björn Nilsson: It is the backbone, and it doesn't have to be perfect. It doesn't have to be mature for you to already get started. In fact, we often have discussions with institutions who tell us, this sounds incredible. This actually sounds like the stuff risk practitioners dream of. Can you come back in two or three years when our data is ready and we've made enhancements to the framework? And the first few times I was so taken aback by the answer because AI can help expedite the journey no matter what your starting point is. If you don't really have an RCSA, AI can either help develop the building blocks, the process and product hierarchy, the controls inventory, even the methodology itself, and actually help you get to a really good V1.

38:22Björn Nilsson: And it does it in a way that's more objective and consistent and informed than a human would do it. And then if you have an RCSA and you're like, we have one, it's still maturing. It's not up to snuff yet, right? There's an opportunity to enhance or rebuild some of the foundation. Gen AI can pressure test with what we call a challenger RCSA, where you provide some of the raw information and agents, then build an RCSA sort of in parallel to what you have. And it compares it to what you have. And then you decide, you know, for the discrepancies, do I actually think that this is right? Is this better?

39:03Björn Nilsson: How do I get to the best average answer? And then finally, there's folks that are quite happy with their RCSAs. They've invested a ton into the programs. They find them quite mature today. And then this is the opportunity to move to real-time insight. And agents can then enable an organization to shift to a dynamic RCSA to have a real-time view of risk and control performance, insight on how external events, changes to the business, impact the bank, and so on and so forth. And so we think that there's an opportunity for everyone.

39:38Anke Raufuss: And to build on that then, what are the initial first steps that you walk clients through if an organization doesn't already have an RCSA and wants to build one to enable this digital twin?

39:49Björn Nilsson: When we go into an organization that doesn't really have an RCSA yet, one of the first steps is to actually map out the organization and think about how do we think about the processes of the organization? And you can imagine all sorts of questions come up, which is, how do I even get started? this feels like I have to send around an army of 200 people to go and write on clipboards and follow people around. Your procedures are generally a great starting point for building out what a process universe looks like. And depending on the industry that you're in, there's often a really great starting point from some of the industry associations, because at the end of the day, we're not all that different in how we operate, at least particularly in banking.

40:36Björn Nilsson: And agents can actually start to take some of these references and some of your procedures and start to build these basic building blocks for you that then become the base of your risk and control self assessment.

40:50Anke Raufuss: And so then what kind of AI capability does one need to get started? Are there any specific models that you recommend?

40:56Björn Nilsson: Any of the established LLMs that everyone uses are perfectly find to help get started on this journey. And there's probably a lot of different systems where your data sits today. To actually even just build some of these agents, it's some Python code right now that sits on top of your other systems. You don't necessarily need a data lake. You don't need to build a new system. This is actually something that we can move a lot faster than a lot of traditional technology or application sort of development, which is really exciting to us.

41:32Anke Raufuss: Indeed. So Anka and Bjorn, do you have anything to add to these points about how to get started on the journey?

41:36Laura Webanck: Maybe one thing to add when you said you can start with policy documents, procedures to basically inform the AI how things should work. I think that's a good starting point. Absolutely. I think the real benefit out of the human expertise and experience over years and years of doing these processes is to sit down with them, talk through and also distill some of that experience into code. That really gives you then the edge of accuracy and not just as it should be, but as it actually is being operated. And the interesting thing when you sit down with a handful of risk managers and talk through these processes, the variability, the variance, how they are actually doing that.

42:29Laura Webanck: The policy says you do it this way, but eventually everyone is their version of the policy. So distilling that and this process also facilitates a drive towards consistency of how you actually do things in the organization, which is a benefit of its own, which leads to many of the other benefits. Yeah, if I could add to that, I think the key is really to start bottom up taking one process and really looking at its end to end. So not doing a top-down view of the entire enterprise, but really selecting one high-value process that is well understood also in the bank, like the lending process or the client onboarding process.

43:15Laura Webanck: And then really taking that process to risk, to control type of mapping, and then trying it out end-to-end. Like how would a digital twin look for a specific process as well? that really also demonstrates the value of it before scaling it.

43:36Anke Raufuss: Awesome. Bjorn, Anka, Laura, thank you so much for taking the time with us today to discuss digital twins and non-financial risk management. Really appreciate it.

43:45Björn Nilsson: Thank you very much. Thank you. Thank you, Sean.

43:48Anke Raufuss: And thank you to all of our listeners for joining us today. We hope you enjoyed the conversation and we welcome your feedback and ideas for future episodes. Just email us at I-T-S-R at McKinsey.com. You can also share your ratings and reviews on any podcast player with many thanks to all who've already done so. We really appreciate the comments and feedback we receive every week and encourage you to keep them coming. And if you enjoy this episode and you'd like to subscribe, we encourage you to follow our weekly series on any podcast player, where you can also access our entire library of more than 300 episodes.

44:21Anke Raufuss: Finally, if you'd like to automatically receive our latest publications and insights, just visit our Risk and Resilience Practice page at mckinsey.com slash risk. You can also connect with us on LinkedIn and we've included those links for you in the show notes. Thanks again for listening. We look forward to having you join us again next week inside the strategy room.