What a deliberately curated cross-section of financial services leaders revealed about AI governance, controls, CPS 230, organisational design and the capabilities required for 2027
Senior Risk and Compliance executives are not short of information, industry invitations or regulatory engagements. What they increasingly lack is the time and space to compare what is actually happening inside their organisations with respected peers who are confronting related issues through different business models, investment structures and regulatory settings.
One executive at Kaizen Recruitment's recent Risk & Compliance Executive Roundtable joked that she had effectively become a hermit. Despite the growing number of regulatory engagements requiring her attendance, she now rarely accepted invitations to external events. Although said lightly, the comment reflected the reality for many leaders in the profession. Their functions are carrying an expanding regulatory agenda while supporting enterprise transformation, significant technology investment, operational resilience, and heightened expectations from boards, regulators and the business.
That reality informed the curation of the roundtable as we aimed to avoid another event built around prepared remarks, familiar industry observations, or a large audience. It needed to justify the time away from the organisations these executives lead. Attendance was by personal invitation and deliberately limited to senior leaders within Kaizen Recruitment's retained client and established executive network. Each person was invited because of the perspective, judgement and generosity they could bring to their peers in the room.
The roundtable was generously hosted in the ESSSuper boardroom by Adam Swanwick, Head of Risk and Compliance, and his team. The discussion was moderated by Alex Lord, Head of Risk & Compliance Frameworks & Assurance at Hostplus, and conducted under the Chatham House Rule so that leaders could speak candidly about what they were implementing, where friction remained and which elements of accepted industry practice warranted closer examination.
The participating organisations collectively represented superannuation, institutional investment, global funds management, private debt and credit, mutual banking, wealth management, managed accounts and investment platforms.
A room deliberately designed to challenge consensus
The breadth of the room was intentional. The objective was to avoid an echo chamber in which one segment of financial services reinforced the existing structures, language, and assumptions it already knew. The purpose was not to arrive at a comfortable consensus about current practice or the future status quo. It was to test whether assumptions formed in one part of the market would withstand the experience of another.
Why did Kaizen invite leaders from different financial services sectors?
This cross-section of financial services businesses may be responding to related governance and resilience questions, but they are doing so within materially different environments. Their ownership models, customers, investment structures, risk appetites, operating dependencies, and levels of organisational maturity are not interchangeable. A model viewed as established in one setting can look considerably less certain when examined by an executive operating under different commercial and regulatory conditions.
There was no expectation that every leader would agree on the ideal Risk and Compliance structure, the balance between centralised and federated accountability, or a single definition of best practice. The value came from understanding why approaches differed and what those differences revealed.
Risk and Compliance functions do not, and should not, compete commercially in the same way as product, investment or distribution functions. There is genuine industry value in creating a trusted environment where leaders can compare practical experience, challenge assumptions and work through common problems without diminishing the accountability each executive carries within their own organisation.
The quality of the room came not from uniformity, but from the calibre of the challenge.
Sharing updated salary guide data and market intelligence before its broader release
Before the discussion commenced, attendees received a private, pre-release briefing from Kaizen Recruitment's Annual Report and Market Update. This early access was reserved for retained clients and senior executives within relationships built over years of appointments, confidential advice and ongoing market engagement.
The briefing included remuneration and benefits data, but it was never intended to be a presentation of salary tables alone. It examined:
The role seniorities attracting investment from these businesses;
The combinations of technical and leadership capability becoming harder to secure;
The markets expanding more rapidly than available talent pools;
The areas that remain constrained, and
The employee psychology influencing whether experienced professionals stay, move or decline an apparently attractive opportunity.
More than half of surveyed professionals feel undervalued in governance, risk and compliance
Kaizen's research indicated that more than half of surveyed professionals felt undervalued, with dissatisfaction increasing from the previous year and salary remaining a primary driver of movement. The more useful conversation, however, was not simply that employees wanted to be paid more. It was why widespread dissatisfaction had not translated into indiscriminate movement. Senior professionals remain highly selective assessing organisational purpose, executive sponsorship, role design, flexibility, the maturity of the function, future risks of redundancies and whether an opportunity represents genuine progression rather than change for its own sake.
What financial services industries have been experiencing the highest and lowest hiring activity?
The pre-release data also showed that the strongest hiring activity was concentrated in superannuation, FinTech and wrap platforms, and private credit, followed by funds management, wealth management and managed accounts, while banking and insurance remain comparatively softer. Those patterns were directly relevant to the composition of the room. Leaders from quite different sectors were confronting remarkably similar questions about governance maturity, accountability, capability design and the return on significant technology investment.
The skills and capability demand within teams were equally instructive.
AI Governance,
Technology Risk,
Privacy,
Operational Due Diligence,
Investment Governance,
Line 2 and Third-Party Risk,
AML/CTF and
Cyber/Data Security
All featured prominently in both the volume of new role creation and strategic workforce planning. These were not experienced as isolated technical disciplines as the discussion repeatedly returned to the intersections between them and to the scarcity of professionals capable of connecting governance, risk, operations, technology and commercial outcomes.
That observation is one of the most important signals within Kaizen's current market intelligence. Future remuneration premiums are likely to attach to multidisciplinary specialist capability rather than narrow, single-domain expertise.
At Kaizen, our value proposition is to support our clients in finding highly specialised professionals with niche and hard to find skillsets as well as those individuals who have gathered multidisciplinary specialist capabilities across various types of roles and annual salary guide scheduled for public release outside of our core client and candidate base in January 2027 will examine the underlying remuneration data in detail. This article is intentionally different. Its purpose is to consider how senior leaders interpreted those signals in the room and what they mean for the design of Risk and Compliance functions.
Kaizen's perspective is informed by annual research and completed placements, but also by hundreds of interviews and thousands of conversations across Kaizen's specialist financial services practices. Those conversations span Legal, Risk and Compliance, Investments, Investment Operations, Funds Distribution, Wealth and Advice, Product, Digital, Marketing and Communications, Finance and broader corporate functions. Formal economic reporting generally identifies movement once it is sufficiently established to measure. Executive search and specialist recruitment offer an earlier view of how strategy is translating into structures, positions and people.
The vacancy is no longer automatically the brief
One of the more important workforce signals within Kaizen's market intelligence is not a wholesale reduction in Risk and Compliance headcount. It is the increasingly intentional pause following a resignation or vacancy. Rather than retrieving the existing position description and commencing a like-for-like replacement, organisations are using the vacancy to reconsider the technical composition of the role, its relationship with the wider business and the commercial outcomes it is expected to support. The headcount may remain, while the position in its previous form may not.
Before returning to market, leaders are asking whether responsibilities should be elevated, redistributed or combined differently, which activities remain valuable, what can now be automated, and which capabilities will be required for the next iteration of the operating model. This is particularly relevant as organisations commit substantial capital to enterprise transformation, automation, AI licences, tokenisation initiatives, data platforms and systems implementation. Boards and executive teams reasonably expect that investment to produce stronger controls, improved information, better decisions, increased efficiency and a credible return on the financial and operational commitment involved.
The workforce implication is more nuanced than a simple prediction that technology will reduce headcount. The more immediate question is whether existing positions have been designed to use the investment effectively. A role previously weighted towards manual reporting, controls documentation or repeatable administration may require a different balance of data interpretation, systems understanding, business partnering, technology governance and professional judgement. In other cases, automation may reduce process work while increasing the need for senior oversight, credible challenge and accountability. Rather than asking who can perform the role as it existed, the more useful question is what the position needs to contribute to the commercial and operating model being built.
The answer may change the level of seniority, reporting line, technical background, remuneration and candidate market. It also explains why relatively stable headcount can conceal meaningful redesign. One role may still be replaced by one person, but the capability entering the organisation can be materially different from the capability leaving it. Across a function, a sequence of these decisions can reshape an operating model without a formal restructure ever being announced. Remuneration benchmarking also requires judgement. The same title can represent materially different scale, mandate, regulatory exposure and organisational authority across two institutions. Salary data is most valuable when interpreted alongside the real complexity of the position and the psychology of the people an organisation hopes to attract. A market range can provide a reference point, but it cannot compensate for an incoherent remit or a mandate that lacks credible sponsorship.
AI governance is exposing the difference between access and capability
Artificial intelligence formed a substantial part of the discussion. Executives described how their organisations were exploring or deploying Microsoft Copilot, Claude and other generative AI platforms, alongside the policies, governance frameworks and guardrails being developed around their use.
What was notable was how quickly the conversation moved beyond theoretical AI risk. Organisations represented in the room are already exploring practical applications of generative AI to productivity, decision-making and operational efficiency, while simultaneously working through the governance, accountability and validation frameworks required to use it responsibly.
One example shared in the room involved entering the same controls-related prompt into an AI tool on separate occasions and receiving different responses and recommendations. The point was not that the technology lacked value. It was that an answer can appear persuasive without being consistent, complete or reliable.
AI governance cannot be resolved through an approved-tools register or employee policy alone. Organisations need clarity about who remains accountable for an output, how it will be validated, where human review is essential and whether employees understand the limitations of the platforms they are using. The risk may not always be an obviously incorrect answer. It may be a plausible answer that escapes the level of challenge it deserves.
This places renewed value on professional judgement. The strongest Risk and Compliance professionals will not be distinguished simply by familiarity with a platform. They will understand its application, recognise where its limitations create risk, test the output and communicate those concerns to stakeholders with different levels of technical fluency. Access to technology does not create capability. People create value when they apply it to a genuine business problem within a sound framework of governance and accountability.
Controls and obligations must produce more than evidence of activity
Controls, obligations and GRC programmes generated some of the most varied perspectives in the room. Executives compared centralised and federated operating models, different levels of investment, and the respective roles of internal teams, external advisers and technology providers.
There is no single structure appropriate for every organization:
A centralised model can improve consistency and visibility but may become disconnected from operational reality.
A federated model can place accountability closer to the activity generating the risk but may create inconsistency or reduce enterprise-wide visibility. The relevant test is whether the model produces clearer ownership, a more effective controls environment and better management decisions.
The investment already committed to controls and obligations uplift was also discussed candidly. For some organisations this has involved substantial expenditure across external advisers, new GRC technology and dedicated internal project resources. That inevitably raises a more commercial question as programmes mature: what has the organisation actually bought? Better documentation and greater visibility have value, but the longer-term test is whether the investment has reduced risk, clarified accountability and created a controls environment the business can maintain without permanent programme infrastructure.
Large uplift programmes can absorb significant consulting expenditure, technology investment and internal resources. Completion of the programme is not proof that the intended governance outcome has been achieved. The more useful questions are whether the business understands its obligations, whether control ownership is clear, whether controls operate as intended and whether management has better information on which to act.
A GRC platform can improve visibility without resolving accountability. A technically complete framework can remain poorly embedded and while another governance layer may provide assurance, it may also unintentionally increase the distance between the risk and the person expected to manage it. This is also why a structural problem cannot be solved indefinitely through one appointment. New talent can add essential expertise, but the role must strengthen the operating model rather than carry the burden of compensating for ambiguity around it.
CPS 230 is moving from implementation to proof
The conversation around CPS 230 had evolved beyond initial readiness. For many organisations, the challenge is no longer documenting critical operations, impact tolerances, controls and service-provider arrangements. The focus with regulatory scruitiny is increasingly on demonstrating that those controls work in practice and exposing the friction that remains within existing structures.
The organisations around the table were at different stages of maturity, which made the comparison particularly useful. Experiences varied across critical operations, dependency mapping, material service-provider oversight and resilience testing, yet the conversation was increasingly converging on what happens after the initial implementation work is complete.
How did this shift in regulatory focus result in short-sighted restructuring and organisations paying out large redundancy packages?
As programme activity moves into business-as-usual operations, responsibility is shifting towards genuine Line 1 ownership and the quality of Risk and Compliance business partnering. A second-line function can establish the framework, provide oversight and deliver challenge, but it cannot own operational resilience on behalf of the business. The relevant business leaders must understand their critical operations, accept responsibility for maintaining them and demonstrate that ownership through daily decisions. We saw this over the past 6 months as increasing demand for Line 1 risk professionals in newly created roles drove our candidate sourcing and placement activity. Unfortunately withing several superannuation organisations we also saw a tightening of the belt across Line 2 teams, resulting in employees impacted by redundancies and, frustratingly not reabsorbed into these new line 1 positions. This in our view is a lack of quality people and culture lenses on the value these individuals with internal deep key person insights within their existing organisations. This played out commercially as redundancy packages were paid out and simultaneously time and resources dedicated to fill these new roles with new staff or outsource the function to shadow workforces at least temporarily to consultancies.
What Risk and Compliance Skills Have Been In Demand the Past 6 Months?
This changes the capability required by Risk professionals. Project delivery remains useful, but the longer-term requirement increasingly includes operational understanding of how a business operates end-to-end. This drove demand for pragmatic business partnering and the ability to influence leaders without absorbing their accountability. Effective partnership should improve ownership within the first line, not quietly transfer it back to the second.
Unsurprisingly, some of the greatest implementation friction appeared at the points where accountability crossed functional boundaries. Risk, Compliance, Operations, Technology and the business may each understand their component of the framework, but sustainable resilience depends on how effectively those accountabilities connect once the programme structure falls away.
Third-party risk is becoming the most revealing part of this next phase. A critical operation may sit within an organisation's accountability framework while substantial elements of delivery are performed by an administrator, custodian, cloud provider, technology partner or another external organisation. Maintaining a register is necessary. It does not establish whether the organisation genuinely understands the businesses on which it depends. Leaders need to know how essential providers operate, how incidents are escalated, which fourth-party dependencies sit underneath the relationship and whether governance and control environments work in practice as described on paper.
They must also ask whether weaknesses would be detected through ongoing oversight or discovered only after disruption. The same issues intersect with CPS 234 where material relationships depend on information systems and data.This led into further discussions on data lakes and privacy standards which most had not found a genuine solution for at this juncture with their outsourced partners.
Effective oversight cannot sit exclusively within Procurement, Technology, Legal, Risk or the relevant business function as each sees a different piece of the holistic lifecycle. The organisation needs people who understand the commercial purpose of the arrangement while being able to examine operational, governance, information-security and concentration risks. An activity can be outsourced. Accountability for its consequences cannot.
Titles are becoming less useful. Combinations of capability matter more.
Although the discussion moved across AI, controls, obligations, operational resilience and third-party risk, the underlying issue repeatedly returned to capability. Kaizen's search work confirms that organisations are becoming more exacting about the capability required in senior Risk and Compliance appointments. Technical credibility remains essential, but it is no longer sufficient on its own, and titles are becoming less useful as a proxy for what a professional can actually deliver.
The briefs attracting the greatest attention increasingly combine disciplines: Risk leadership with technology fluency; Compliance depth with operational influence; Controls expertise with data capability; Legal judgement with governance and commercial understanding; and regulatory credibility with the ability to lead transformation.
The market is not abandoning specialist knowledge. It is placing a premium on the ability to connect specialist knowledge to other parts of the organisation.
- A strong example of this was Kaizen’s partnership with a large industry super fund to build stronger corporate governance capabilities into their specific asset class teams. This meant providing talent to sit in a specific portfolio team, partnering with their Portfolio Managers, Investor Communications stakeholders and Heads of Asset classes to better strengthen the reporting quality and corporate governance lens as these individual asset class reports are fed up to the larger board and investment committee packs. This required sourcing individuals with existing corporate governance and board secretarial backgrounds who had also had experience working ion investment management and understood the ecosystem, structures and subject matter.
That does not mean every position should become an exhaustive hybrid. One of the clearest risks in the current market is the attempt to place every unresolved organisational need into a single position description. Scarce capability commands a premium, while an incoherent remit simply discourages the strongest people from engaging.
Senior candidates assess more than salary as they assess the credibility of the hiring manager, the maturity of the surrounding function, the authority attached to the role, the organisation's appetite for change and the personal risk involved in leaving a secure position. Salary data is therefore most useful when interpreted alongside the complexity of the mandate and the psychology of the people an organisation hopes to attract. This is one of the reasons specialist search advice should begin before a position description is finalised.The best candidates are usually not actively applying in the market and require advocates in tehri own network or trusted specialist recruitment consultants to get them to the table and consider the opportunity in the first instance.
Creating the next rooms with the market, not for it
The objective of the roundtable was not to manufacture a public consensus or produce a predetermined list of conclusions. It was to create a trusted forum in which a carefully selected group of leaders could examine difficult questions with peers beyond their immediate sectors, supported by current market intelligence and credible industry moderation.
Every participant was invited because they could add something meaningful. The strength of the discussion came from executives who were prepared to share their experience as generously as they examined the contributions of others. Following the event, attendees were polled on the themes they believe warrant deeper examination. Their responses will shape a programme of small, bespoke forums, each built around a clearly defined industry issue and the leaders best placed to contribute to it.
Where relevant, those forums will also introduce integral market makers and specialists who can add another dimension to the problem. The intention is not to create event volume. It’s to continue building rooms in which the composition of the group is as carefully considered as the subject itself, and where Risk and Compliance leaders can work through shared industry challenges without commercial competition.
This is a natural extension of executive search and organisational advisory work. Kaizen's role does not begin when a vacancy is approved and end when an appointment is made. It includes helping organisations interpret the market they are entering, test whether a proposed mandate and remuneration are credible, understand where capability is becoming scarce and consider whether a role has been designed for the organisation they intend to build.
Cautioning Financial Services Organisations From Losing Talent only to Pay to rehire it again in 3-6 months
The next iteration of Risk and Compliance will not be determined by regulation or technology in isolation. It will depend on whether organisations can translate investment into capability, establish genuine ownership within the business and design functions that remain useful as the operating environment changes. Continued short-sighted firing and hiring does not improve either the external reputation of an organisation with future employees, nor does it benefit the business internally as they lose qualified and capable talent due to not taking the time to understand how their people can be recycled through the organisation in new roles. With AI and technology continuing to refine current roles and PDs, we would caution businesses to be mindful of getting into this trap.
The roundtable did not attempt to settle those questions in one afternoon. It allowed an exceptional group of leaders to compare how they are approaching them, challenge prevailing assumptions and contribute to a more informed conversation about what comes next. That was the value of the room, and it is why access to the right room still matters.
Risk and Compliance Leadership FAQs
What are the major priorities for Risk and Compliance leaders heading into 2027?
The priorities discussed included responsible AI governance, sustainable controls and obligations management, operational resilience, CPS 230, third-party oversight, information-security risk and stronger Line 1 ownership. Leaders were also reassessing whether their operating models, technology investment and workforce capability were aligned with those priorities.
How is AI changing Risk and Compliance functions?
AI is improving access to information and creating productivity opportunities, but it does not remove the need for validation, accountability and professional judgement. Risk and Compliance leaders are developing frameworks that address acceptable use, human oversight and the possibility of plausible but inconsistent outputs.
How is CPS 230 changing Risk operating models?
As implementation moves into business-as-usual operations, CPS 230 is increasing the importance of Line 1 ownership. Risk functions need to provide effective challenge and practical business partnership while ensuring accountability for critical operations remains with the relevant business leaders.
Why is third-party risk oversight becoming more important?
Financial services organisations increasingly depend on administrators, custodians, technology platforms, cloud services and other outsourced providers. Effective oversight means understanding how essential partners operate, manage incidents, oversee their own dependencies and maintain resilience under pressure, not simply recording them in a register.
How are technology investments changing Risk and Compliance roles?
Organisations are increasingly using a vacancy to consider what the next iteration of the role should deliver. Positions previously focused on manual reporting or controls administration may require stronger data, technology-governance, business-partnering and professional-judgement capability.
Why does organisational design matter in Risk and Compliance?
Clear ownership, decision rights and relationships with the business determine whether a framework works in practice. Additional people or technology cannot indefinitely compensate for an operating model in which accountability is unclear or assurance is disconnected from operational activity.
What influences senior candidates beyond salary?
Senior professionals consider executive sponsorship, authority, organisational maturity, flexibility, culture, purpose and the organisation’s genuine willingness to support change. Remuneration matters, but it is only one part of the decision to leave an established position.
Why did Kaizen invite leaders from different financial services sectors?
The cross-section was designed to avoid an industry echo chamber. Leaders from superannuation, funds management, private credit, banking, institutional investment, wealth and platforms were able to test assumptions against different operating models, customer groups and regulatory settings.
What did Kaizen share with roundtable attendees before the discussion?
Attendees received a pre-release briefing from Kaizen's Annual Report and Market Update covering remuneration and benefits, employee psychology, organisational design, capability shortages, in-demand seniorities and the parts of financial services experiencing expansion or constraint.
How will Kaizen shape future executive roundtables?
Attendees were polled after the event on the issues they believe require deeper examination. Their responses will inform small, bespoke forums that connect relevant leaders, peers and market specialists around clearly defined industry challenges.
