This week, I published the Risk Consulting Services Landscape Q3 3026 (Forrester clients only). This is our first review of the landscape for risk consulting firms advising risk, compliance and internal audit leaders. Until the introduction of AI into our lives in late 2022, services offered by risk consulting firms had changed little since I hung up my consultant boots some years ago. Internal audit and controls testing, assurance and assessment support used to make up a large proportion of services revenue in this market. In the last two years, this has evaporated and the mix of services is shifting rapidly as traditional services offerings begin to fade into irrelevance as the white heat of AI makes its impression on the market. Risk leaders should look for risk consulting firms that enable them to:

  • Both manage and govern AI risk. Risk leaders are struggling to meet growing AI regulatory mandates while sating the business’s insatiable appetite for enterprise-wide AI adoption. Business demand vastly outstrips risk professionals’ ability to understand and manage AI risk quickly enough, leaving significant AI governance and risk management gaps at enterprises as the business moves on regardless. Risk consulting firms have rapidly built AI capabilities and shifted consultants to meet demand that scarcely existed three years ago. Risk leaders still need support understanding business AI use cases and services and bringing skunkworks AI activity into formal governance. Look for risk consulting firms that address both formal AI governance needs and ungoverned AI risks.
  • Transform their functions to be more operationally efficient. Risk and internal audit functions still need traditional risk consulting services to exercise their traditional oversight roles. They will also seek to demonstrate how their functions are leveraging AI to be more operationally efficient. As the traditional manual work gets automated over the coming years, the demand for it will reduce. In response, risk consulting firms are investing in risk function and program transformation, with risk technology enabling greater effectiveness and efficiency with AI and other automation opportunities. Risk leaders increasingly want advisors who can drive transformation, not just deliver reports. I expect this transformation and technology work to account for over half of demand within three years.
  • Tie fees to transformation outcomes. My colleague Ted Schadler has long forecast the death of the traditional time and materials model as part of broader services markets trends, a trend I observed as a consultant some years ago referred to as the “Scissors of Death”. In the current landscape, risk consulting firms have long relied on fixed fee engagements to deliver standard engagements such as SOX compliance testing or SOC2 attestations, but their customers’ demand will change significantly in the next two years towards delivery of transformation of risk programs and functions. Risk leaders will start using milestone-based payments linked to outcomes delivery, and in some well understood cases adventurous risk leaders will tie fees to productivity or cost savings, especially in technology implementation projects where the projected benefits are often expressed as cost savings from implementation of AI.

I will be launching the inaugural Forrester Wave™: Risk Consulting Services, Q1 2027 with work starting on this project now. Forrester clients can read The Risk Consulting Services Landscape, Q3 2026 here. Customers wishing to discuss the market or selection of providers can schedule a guidance session or inquiry with me.

Share