88% of respondents to the 2025 Wolters Kluwer Regulatory & Risk Management Indicator survey reported using manual processes and spreadsheets often or sometimes.
Manual risk management, meaning risk registers, self-assessments, key risk indicators and control testing run on spreadsheets and email, remains the normal arrangement at US financial institutions.
This article covers the scope of those figures, where manual effort concentrates, what the prevalence and error research supports, and how automated risk management is implemented. See our AI compliance readiness assessment to learn more and evaluate your team’s own readiness.
What These Statistics Cover
Six process areas are in scope, and they are:
- The risk register
- Risk and control self-assessments
- Key risk indicators, control testing
- Issue tracking
- Board risk reporting
A process counts as manual when its record lives in a spreadsheet, an email thread or a shared-drive folder, with no single system holding data and workflow together.
Where Manual Risk Management Effort Concentrates
Manual risk management follows a repeating cycle where risk identification produces a register held as a workbook, and assessment cycles go out as spreadsheet templates and come back by email, where someone then reconciles the returns.
Key risk indicator values are keyed in by hand from core systems, loan origination platforms and incident logs, on a cadence set by whoever collects them. Control testing is evidenced in shared-drive folders named by tester and date. Issues raised during testing move to a separate list.
Three failures recur in spreadsheet risk management:
- Version reconciliation after distributed edits
- Evidence that cannot be traced to the control it supports
- A reporting lag set by the slowest return
Prevalence and Program Maturity
Wolters Kluwer polls US banks, credit unions and lending organizations every year for its Regulatory & Risk Management Indicator survey. The 2025 edition put combined “often” or “sometimes” use of manual processes and spreadsheets at 88% and named manual processes the biggest obstacle to maintaining effective compliance programs.
Program maturity is measured separately. The 2025 State of Risk Oversight report from the NC State ERM Initiative and AICPA surveyed 273 US organizations, 76 of them financial institutions, and found 35% reporting comprehensive enterprise risk management processes in place.
The manual risk management statistics below carry the publisher and year for each figure.
| Figure | What It Measures | Source | Year |
|---|---|---|---|
| 88% | Manual processes and spreadsheets used “often” or “sometimes” | Wolters Kluwer Indicator | 2025 |
| 42% / 31% | Manual use split “often”/”sometimes”, 258 respondents | Wolters Kluwer Indicator | 2024 |
| 35% | Organizations with comprehensive ERM processes in place | NC State ERM and AICPA | 2025 |
| 57% | Organizations reporting top risks to the board | NC State ERM and AICPA | 2025 |
| 86% | Operational spreadsheets containing errors, 1997-2000 audits | Panko, EuSpRIG review | 2000 |
| 80% | Data quality named the top barrier to AI in risk work | IIF and EY survey | 2025 |
Error Rates, Data Quality, and Evidence Gaps
In the 15th annual IIF and EY Global Bank Risk Management Survey, covering 101 banks across 31 countries in late 2025, 80% named data quality and availability as the leading barrier to applying AI in risk management.
The FT Longitude and SAS survey of 300 senior banking risk executives, published in March 2025, found 75% intending to increase risk technology investment, up from 51% in 2021.
Automated Risk Management in Practice
Risk management automation replaces the spreadsheet as the system of record.
Predict360 maintains a common taxonomy of risks and controls across business units, schedules recurring risk and control self-assessments while tracking the progress of concurrent assessments independently and identifies controls operating outside tolerance levels in real time.
Its key risk indicator engine collects values through manual input, API or SFTP import and calculates them against defined upper and lower bounds. Request a demo to learn more about our risk intelligence platform.
“Predict360 is a powerful tool that we have come to depend on. It makes performing risk assessments easier and issues management much more efficient. It is an ideal product for those risk teams looking to increase their productivity and get a clearer view of risks across the organization.”
— Heather D. via Sourceforge.net
Frequently Asked Questions
How many banks still use spreadsheets for risk management?
The 2025 Wolters Kluwer Regulatory & Risk Management Indicator survey reports 88% of respondents at US banks, credit unions and lending organizations still use manual processes and spreadsheets often or sometimes. The 2024 edition split that into 42% often and 31% sometimes across 258 respondents.
Why automate manual processes in risk management?
Automation targets three measurable problems: the reconciliation time spent merging returned assessment templates, the reporting lag created by hand-collected indicator data, and control evidence that cannot be tied to what it tests. It also removes the rekeying step, where indicator values are transcribed by hand from core and origination systems each cycle.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring