This week, I published The Risk Consulting Services Landscape, Q3 2026 (Forrester clients only). This is our first review of the landscape for risk consulting firms advising risk, compliance, and internal audit leaders. Until the introduction of AI in late 2022, services offered by risk consulting firms had changed little since I hung up my consultant boots some years ago. Internal audit and controls testing, assurance, and assessment support used to make up a large proportion of services revenue in this market. In the last two years, this has evaporated: The mix of services is shifting rapidly as traditional services offerings begin to fade into irrelevance, with the white heat of AI making its impression on the market. Risk leaders should look for risk consulting firms that enable them to:

  • Manage as well as govern AI risk. Risk leaders are struggling to meet growing AI regulatory mandates while sating the business’s insatiable appetite for enterprisewide AI adoption. Business demand vastly outstrips risk professionals’ ability to understand and manage AI risk quickly enough, leaving significant AI governance and risk management gaps as the business moves on regardless. Risk consulting firms have rapidly built AI capabilities and shifted consultants to meet demand that scarcely existed three years ago. Risk leaders still need support for understanding business AI use cases and services and bringing skunkworks AI activity into formal governance. Look for risk consulting firms that address both formal AI governance needs and ungoverned AI risks.
  • Transform their functions to be more operationally efficient. Risk and internal audit functions still need risk consulting services to exercise their traditional oversight roles. They’ll also seek to demonstrate how their functions are leveraging AI to be more operationally efficient. As traditionally manual work gets automated over the coming years, the demand for it will reduce. In response, risk consulting firms are investing in risk function and program transformation, with risk technology enabling greater effectiveness and efficiency with AI and other automation opportunities. Risk leaders increasingly want advisors who can drive transformation, not just deliver reports. I expect this transformation and technology work to account for over half of demand within three years.
  • Tie fees to transformation outcomes. My colleague Ted Schadler has long forecast the death of the traditional time-and-materials model as part of broader services market trends — a trend I observed as a consultant some years ago known as the “scissors of death.” In the current landscape, risk consulting firms have long relied on fixed-fee engagements to deliver standard engagements like SOX compliance testing or SOC 2 attestations, but their customers’ demands will change significantly in the next two years toward delivery of transformation of risk programs and functions. Risk leaders will start using milestone-based payments linked to outcomes delivery, and in some well-understood cases, adventurous risk leaders will tie fees to productivity or cost savings, especially in technology implementation projects where the projected benefits are often expressed as cost savings from implementation of AI.

I will launch the inaugural Forrester Wave™ covering risk consulting services in Q1 of next year, with work starting on this project now. Forrester clients can read The Risk Consulting Services Landscape, Q3 2026. Customers wishing to discuss the market or selection of providers can schedule a guidance session or inquiry with me.

Share