The recent performance of the global risk services market has been underwhelming. Although it has outperformed the professional services market as a whole, the growth rate has been significantly lower than not only the heady days of 2021-22, but also its long-term historic norm of around 8%.

That’s changing. Why? Firstly, clients are facing multiple pressures: the volume and urgency of their work; the fact they’re dealing with new risks of which they have limited experience; and the need to automate and AI-enable risk-related activities—35% say that the biggest internal barrier they face in delivering their risk priorities is that there’s been insufficient investment in technology in the past, at a time when their work is becoming more complex. Secondly, clients recognise that they need—and don’t have—new risk-related skills, without which it will be hard for them to support the faster, more strategic decision making required by their organisation in the future.

Put all this together, and it’s not surprising that risk management is now in the top three areas in which clients expect to use external support. Ninety-two percent of clients say they’ll use more outside help around risk in the next 12 months, with a quarter saying their usage will increase “significantly”.

But at the heart of this shift in demand is a debate about the kind of help clients need and who gets to provide it. For the last 10 years, the risk market has been splitting in two, but AI, changing definitions of risk, and the advent of new entrants are creating new opportunities and challenges.

Bifurcation is a professional services industry-wide phenomenon. Clients see a big and growing difference between technology-enabled, low-cost services and high-value services that depend on being able to apply deep expertise in new ways to complex problems. Go back 20 years and most services—and consequently, most firmsinvolved a mixture of the two. This led to frustration among clients, who felt they were overpaying for some services, even while they were prepared to pay more for others—hence the desire to separate the two business models more clearly. Where risk services are concerned, this has meant regulatory compliance and other rules-based risk work being pushed to the low-cost end of the spectrum, to be standardised, nearshored, and/or automated, leaving strategic risk governance at the other end, an important but traditional advisory market.

Even last year, when clients were starting to learn how to live with the polycrisis, it was obvious that this split was crumbling. Yes, clients still saw compliance as a major challenge, but creating a more forward-thinking risk function, better able to plan for future crises, based on better data and more senior leadership time, was an even bigger one.

At the same time, AI promises not only to improve the automation of low-cost work but also to provide value-adding tools that help to improve discussions and decision-making during high-value work. Twenty-six percent of clients say they’re already making use of AI to help increase their resilience, and 34% that they’re using external support to help them do so. The fact that technology is now playing a critical role at both ends of our spectrum is creating new opportunities. One hundred percent of risk clients we surveyed last year expressed an interest in a service that combined software, proprietary data, and deep expertise (which we’d argue is a new generation of managed services); 69% said they were very interested.

These developments create opportunities in the risk services for new firms and will force incumbents to change.

The Big Four have long dominated the market for risk support. Indeed, they practically invented it, and their combined share of the market today is larger than that of most other players put together. In size terms, their nearest competitors are mid-tier accounting firms. Established specialist risk consulting firms have about a tenth of the market. However, we estimate that law firms have about 8%, technology firms 6%, and strategy firms 4%.

Each of these last three poses a challenge to the audit and assurance firms, both big and mid-sized. Technology firms have built up a strong presence at the low-cost end of the risk services spectrum, but AI will give them opportunities to move into the higher-value space, provided they can demonstrate to clients that they have sufficiently deep risk expertise. The strategy firms have been building up their risk expertise; for them, AI is an opportunity to extend their reach into the higher-value aspects of implementation, enabling them to better leverage organisations they’re already partnering with in this space. Law firms have been able to bolster their expertise around regulation and existing investment in AI and other technology by recruiting senior risk experts from the Big Four.

With everyone converging on the same space, the winners will be those that take and hold the middle ground, offering a combination of low-cost and high-value services, enabled by AI, and delivered by experts.

What can firms do next?

Is your firm positioned to benefit from the resurgence in demand for risk services? If you’d like to understand more about the opportunities available to your firm within the risk market, please do get in touch; our market sizing data and investment strategy studies can help.