A compliant risk management framework is the baseline. Regulators now expect firms to show what it actually delivers for customers.

Most regulated firms can say yes to having a risk management framework. Ask what it has done for their customers and the answer gets harder. That gap was the starting point for our recent webinar, and it comes down to one point:

‍The existence of a compliant risk management framework, by itself, does not guarantee good consumer outcomes.

Regulators are moving from prescription to outcomes

The Central Bank of Ireland (CBI) and the PRA/FCA are maturing beyond prescriptive rules towards outcomes. It shows in the Consumer Protection Code 2025 in the Republic of Ireland and the Consumer Duty regime in the UK.

The CBI’s supervisory principles are outcomes focused, risk based, forward looking and judgement led with responsibility resting on firms. The FCA’s Consumer Duty asks firms to act in good faith, avoid foreseeable harm and support customers’ financial objectives, across four outcomes. While the regulator sets the outcome, the firm must decide how to deliver it and prove it.

Compliance remains the baseline and an outcomes approach is the next step on the path to risk maturity.

Why good intentions are not enough

Firms have traditionally relied on market penetration, retention, low arrears and few complaints as indicators of sentiment. These tell you when something has gone wrong, not that things are going right. Low complaints might mean satisfied customers, or customers who gave up. Strong retention might mean loyalty, or inertia.

‍

Absence of negative indicators is not enough. Evidence of good outcomes is what’s really required.  

Look from the outside in, and build outcomes in from the start

• Ask consumers what they want and measure performance against their feedback

• Require every new product business case to say what is in it for the consumer, rather than assuming it

• Test every consumer digital journey and consider operational resilience from the consumer’s perspective

• Document desired outcomes in strategic plans and product descriptions, and run consumer protection gap analysis on current and planned products

• Record no-blame lessons from incidents and near misses, and announce changes made because of consumer feedback

If nobody wrote down what a product was meant to achieve for the consumer, there is nothing to measure it against later.

Measurement is vital

We suggest five lenses. Financial and operational resilience are included because a firm that can’t stay sound or keep services running will struggle to deliver good outcomes.

• Governance (long-term sustainability): risk-based decisions visible in documentation, outcomes evident in strategic planning minutes, conflicts of interest managed and open engagement with regulators.

• Financial resilience (staying financially resilient): KPIs that forewarn of negative trends, reserves and liquidity, asset-to-liability ratios, accurate and timely regulatory returns.

• Operational resilience (service through disruption): downtime affecting consumers, provider recovery times and SLA performance, key person dependency, scenario and penetration testing.

• Product or service (specific to your industry): satisfaction surveys, repeat custom, and early or frequent cancellations that may signal a weak sales process or an unsuitable product.

• Consumer (the quality of the journey): early signs of payment difficulty, fair value checks, engagement across the lifecycle, accessibility for consumers with characteristics of vulnerability and the experience of third parties between you and the consumer.

Measurement means nothing without response

Test your assumptions about products and services regularly and test that the underlying controls work. Then learn the lessons by acting on findings, remove barriers and communicate feedback where appropriate.

Where to start

1. Pick one product and write down the outcome it should deliver for the consumer.

2. Ask customers what matters to them and compare that with what you measure today.

3. Add at least one positive-evidence KPI, not just complaints and arrears.

4. Test one control that underpins that outcome.

5. Decide who acts on the findings and how you will tell customers what changed.

The bottom line

Compliance tells the regulator your framework exists. Outcomes tell your customers, your board and your regulator that it works.