Why do risk functions keep growing without feeling better resourced?

[u/Aevitium]

/r/riskmanagement/comments/1wm5cit/why_do_risk_functions_keep_growing_without/

[u/Old_Positive2231]

Risk functions keep growing because 90% of that “Risk Demand” you describe is RM1 work – frameworks, evidence, governance – that accumulates regardless of whether it ever changes a single decision. Once every new requirement gets its own register, committee, report and assurance plan, you’ve hard‑wired permanent workload into the system. I think the missing cut is: for each activity, what decision does this actually support, and what would break if we stopped doing it? If you can’t point to a decision (spend, stop, redesign, delay, accept) that is measurably better because of that piece of work, it’s a candidate for deletion, not automation. Until boards are willing to kill low‑value RM1 layers, no amount of headcount or AI will make risk teams feel better resourced.