In the latest Spotlight on Women in GRC podcast, host Lucy Montague speaks with Rebecca McLean, AXA Insurance’s Risk, Conduct & Governance Director, a senior risk leader with experience across insurance, broking, governance, operational risk, control optimization, and regulatory transformation, and the winner of 2025’s Risk Role Model of the Year at the Women in GRC Awards. 

In this Women in GRC podcast episode, AXA Insurance’s Risk, Conduct & Governance Director shares: 

• Why the biggest risk conversations are rarely about risk 

• How effective risk teams create value before a risk materializes 

• Why organizations should rethink their approach to controls 

• How Consumer Duty has changed expectations of risk and compliance 

• Why commercial awareness matters as much as technical expertise 

• How first-line risk functions can strengthen business performance 

Throughout the episode, Rebecca challenges several assumptions about modern risk management, arguing that the most effective risk functions don’t simply identify risks. They help organizations make better decisions, improve outcomes, optimize controls, and create measurable business value. 

How to manage the difficult conversations in relation to risk  

Rebecca talks to the importance of empathy and broad business knowledge, when asked about the challenging conversations risk leaders have to have with executive teams. She stats that difficult risk conversations frequently aren’t about the risk itself. Instead, they’re about everything surrounding it. For example: 

• Growth targets 

• Strategic objectives 

• Revenue pressures 

• Resource constraints 

• Customer expectations 

• Regulatory requirements 

• Operational realities 

These factors often collide in a single decision. 

As Rebecca explains:

“It’s rarely the thing that you’re actually raising in the moment.” 

Rebecca McLean, Risk, Conduct & Governance Director, AXA

Many risk professionals assume that if stakeholders disagree with them, they simply haven’t understood the risk. In reality, stakeholders may understand the risk perfectly well. The challenge is that they are balancing that risk against a range of competing priorities. 

Rebecca gives an example at one of her previous organizations following regulatory intervention. The need to strengthen controls was clear. However, the tension emerged because stronger controls also affected sales activity, growth ambitions, and commercial performance. 

The conversation therefore became far more complicated than: “Should we address this risk?” The real question became: “How do we address this risk without damaging the objectives the business is trying to achieve?” 

That distinction matters because it changes the role of risk. A risk function that only understands the risk may struggle to gain support, but if you understand the business context surrounding the risk is far more likely to influence outcomes. The data backs this up, as according to PwC’s Global Risk Survey, organizations that embrace strategic, integrated risk management are 5 times more likely to deliver high stakeholder confidence and better overall business outcomes.  

This point is illustrated in former Deloitte partner, Emma Price’s Spotlight on Women in GRC episode too: 

“Understanding risk isn’t the objective. Achieving your objectives is.” 

Emma Price, Partner, Brave  

By transforming risk management from an oversight function into a decision-support function, that is where much of risk’s value is created.  

Risk management creates value long before a risk materializes 

Many organizations struggle to articulate the value of risk management. Compliance can point to regulatory adherence, Sales can point to revenue, Operations can point to productivity, but Risk sometimes appears harder to quantify because its success is often invisible. When risk works, nothing happens: no breach, regulatory enforcement,  major control failure, nor operational disruption. 

But Rebecca argues that viewing risk purely through avoided incidents significantly understates its contribution. As she puts it: 

“Risk frameworks don’t manage risk, people do.”

Rebecca McLean, Risk, Conduct & Governance Director, AXA

This perspective shifts attention away from documentation and toward behavior. The ultimate goal is improving decisions. Rebecca repeatedly returns to the idea that risk adds greatest value when it becomes involved early enough to influence outcomes. 

“Bring us in early and we can help you, and we will support you to achieve what you want to achieve.”

Rebecca McLean, Risk, Conduct & Governance Director, AXA

This could mean: 

• Challenging assumptions during strategic planning 

• Evaluating risks before a new product launch 

• Reviewing control effectiveness before an issue materializes 

• Helping leaders think through unintended consequences 

• Identifying emerging risks before they escalate 

In each case, value is created before a formal risk event occurs. That may sound obvious, but many organizations still engage risk functions too late. Risk is asked to review what already exists. At that point, change becomes expensive and to wider stakeholders, risk’s recommendations are frustrating.  

By implementing risk from the start, it increases the likelihood that strategic objectives are achieved successfully. This approach aligns closely with how many organizations are now thinking about resilience. 

According to the Business Continuity Institute, operational resilience programs continue to expand globally, with over 70% of organizations now operating formal programs. Increasingly, those programs focus not just on recovery after disruption but on anticipating and reducing disruption before it occurs.  

Resilience isn’t simply about recovering from failure, good resilience reduces the likelihood and impact of failure. Similarly, risk management isn’t simply about documenting threats, good risk management improves decisions before those threats materialize. This creates a more useful test of risk maturity. 

Mature risk functions shouldn’t be assessed solely on the number of incidents prevented, rather they should also be assessed on: 

• Strategic initiatives successfully delivered 

• Investment protected 

• Costs avoided 

• Opportunities pursued responsibly 

• Better outcomes produced 

That lens makes risk management easier for executive teams to understand. 

“The best risk functions aren’t measured only by what they stop. They’re also measured by what they help achieve.”

Rebecca McLean, Risk, Conduct & Governance Director, AXA

Most organizations are focusing on the wrong controls 

If risk management has a value challenge, controls often have an effectiveness challenge. Rebecca highlights a common issue across organizations: too many controls are designed to identify problems after they have occurred. 

As she explains: 

“A lot of controls are detective in nature, so they tell you when something’s actually gone wrong rather than prevent the thing from going wrong in the first place.”

Rebecca McLean, Risk, Conduct & Governance Director, AXA

Detective controls have an important role, they are inherently reactive. The question becomes whether organizations are investing enough energy into prevention? 

Rebecca believes many organizations should spend more time thinking about: 

• Preventative controls 

• Automated controls 

• Control effectiveness 

• Control optimization 

• Cost of control 

This is a particularly relevant as organizations invest heavily in compliance, resilience, cyber security, AI governance, and operational risk programs. Not all controls deliver equal value, some controls significantly reduce exposure, others consume time and resources without meaningfully improving outcomes. 

High-performing risk functions therefore ask tougher questions. 

• Does the control work? 

• Is it proportionate? 

• Is it still necessary? 

• Could it be automated? 

• Could it be simplified? 

• Could several controls be replaced by one better control? 

Those questions become even more important in highly regulated sectors. 

The introduction of frameworks such as DORA, Consumer Duty, operational resilience requirements, and increasing third-party risk expectations has encouraged many organizations to build larger control environments. Yet larger control environments are not automatically better control environments. For example, a control that exists only because it has always existed is not necessarily providing value.  

Rebecca’s believes, rather than assuming more controls equals better risk management, she advocates understanding whether controls actually contribute to business objectives. 

 “If a control is partially effective or not effective, that’s a great opportunity. That’s not something that you need to be scared about.” 

Rebecca McLean, Risk, Conduct & Governance Director, AXA

To do this Rebecca recommends leveraging technology, as: 

• Automation creates opportunities to reduce manual effort. 

• AI introduces opportunities to improve monitoring and analysis. 

• Digital platforms create opportunities to connect risk and control data more effectively. 

It’s time to rethink whether those controls are required in their current form at all. 

Deloitte’s risk advisory paper states: “Many different methods can be used to rationalize controls. Most often, it is also the basis of the actual controls execution that can be streamlined such as clear instructions regarding controls execution.” 

Consumer Duty changed the rules for risk and compliance 

Lucy Montague also asked AXA Insurance’s Risk, Conduct & Governance Director about the changes she has seen in her 20 year career, particularly in regard to regulatory focus. Few regulatory developments have influenced UK financial services as significantly in recent years as Consumer Duty, and for Rebecca, its impact extends well beyond compliance. It has fundamentally changed how firms think about outcomes. 

As she explains:

“Consumer Duty has definitely raised the bar.”

Rebecca McLean, Risk, Conduct & Governance Director, AXA

Historically, many firms focused heavily on demonstrating compliance with requirements. Consumer Duty introduced a different expectation. Organizations now need to demonstrate that customers receive good outcomes. The focus moves beyond process compliance toward evidence, outcomes, customer impact and decision quality. 

This shift remains a significant priority for the Financial Conduct Authority, which continues to position Consumer Duty as a key part of its regulatory strategy. The FCA has stated that it increasingly intends to rely on the Duty rather than introducing additional prescriptive rules and continues publishing examples of both good and poor practice.  

For risk functions, this changes expectations in regard to needing: 

1. Stronger outcome monitoring 

2. Better management information 

3. Greater confidence in the evidence supporting decisions 

Consumer Duty has effectively challenged organizations to prove that governance arrangements are working in practice, a different challenge from merely proving they exist on paper. 

Rebecca sees this as part of a broader trend across risk and compliance where, stakeholders, boards, regulators and customers want evidence. 

The FCA’s ongoing publications reflect this reality. Areas such as outcomes monitoring, consumer understanding, complaints analysis, vulnerability, and governance reporting remain key focus areas for firms implementing Consumer Duty.  

This has implications beyond financial services like healthcare and utilities, as we’ve seen in our recent news and trends articles, many industries are moving toward outcome-focused oversight. As customers expect more transparency, stakeholders expect greater accountability, and organizations are increasingly judged not only on processes but on results. 

Consumer Duty simply makes that expectation more explicit. 

For risk leaders, the lesson is clear. The future belongs to organizations that can connect risk, governance, controls, and decision-making directly to measurable outcomes, for a more effective way to manage risk. 

The future of risk belongs to business-focused risk leaders

Rebecca’s experience suggests that the distinguishing characteristic of a high-performing risk function is  business understanding from objectives, to people, to trade-offs:

“The purpose of our business is to protect what matters to people.” 

Rebecca McLean, Risk, Conduct & Governance Director, AXA

The most effective risk functions don’t wait for incidents before proving their value, they influence decisions earlier, and optimize controls rather than simply expanding them, focusing on outcomes rather than activity. 

“We help you land and deliver what you need to land and deliver in a safe and sustainable way.” 

Rebecca McLean, Risk, Conduct & Governance Director, AXA

If you would like to learn more about tying objectives to your risk program in an effective way, discover BRAVE’s Objectives@Risk methodology.

About Rebecca McLean 

Rebecca McLean is a senior risk leader in the financial services sector with experience across insurance, broking and risk management disciplines. Her work spans first-line and second-line risk, governance, operational risk and regulatory change. 

About Spotlight on Women in GRC 

Spotlight on Women in GRC is a podcast series hosted by Lucy Montague and supported by CoreStream GRC, highlighting the experiences and insights of women shaping the future of governance, risk and compliance. 

Frequently Asked Questions on effective risk management

Condensed transcript of the Rebecca podcast episode 

Lucy 

Welcome to Spotlight on Women in GRC, a podcast series celebrating the women shaping the future of governance, risk and compliance. 

Today I’m joined by Rebecca McLean, a senior risk leader at AXA Insurance. Rebecca, thank you for joining us. 

Career journey into risk 

Lucy 

Tell us a little about your role and career journey. 

Rebecca 

I’m a Risk, Conduct and Governance Director at AXA Insurance. 

Like many people in risk, I didn’t start my career expecting to end up here. My journey has taken me across a variety of risk, governance and compliance roles, including time in insurance and broking environments. 

One of the things I’ve enjoyed throughout my career is the variety. Risk gives you exposure to many different parts of the business, different stakeholders and different strategic challenges. I’ve always enjoyed understanding how organizations work and helping leaders make better decisions. 

Understanding the reality behind risk conversations 

Lucy Montague 

One of the topics we discussed was managing difficult risk conversations. What have you learned over your career? 

Rebecca 

One thing I’ve learned is that the conversation is often not really about the risk itself. 

It’s rarely the thing that you’re actually raising in the moment. 

People have commercial objectives, operational pressures, financial targets and competing priorities. The challenge for a risk professional is understanding what sits behind the discussion and finding a way to have a constructive conversation about balancing those different considerations. 

I’ve worked in environments where regulatory intervention meant we needed to strengthen controls significantly. Nobody disagreed that improvements were needed. The challenge came when those changes affected sales activity, growth ambitions or operational performance. 

That’s where risk professionals need to understand the wider business context. 
 

Why effective risk functions create value 

Lucy Montague 

There is often a challenge around demonstrating the value of risk management. What’s your perspective on that? 

Rebecca 

Risk frameworks are important. 

But risk frameworks don’t manage risk, people do. 

Sometimes risk professionals underestimate the value they create because success can be difficult to see. If a project avoids a significant issue because risk was involved early, people don’t always recognize what was prevented. 

I think the biggest opportunity is being involved as early as possible in decision-making. 

Bring us in early and we can help you. 

Risk can support better project outcomes, help organizations avoid remediation activity later, and identify issues before they become bigger problems. 

The greatest value often appears long before a formal risk event occurs. 

Rethinking controls 

Lucy  

You spoke during the podcast about preventative and detective controls. Why is that important? 

Rebecca 

Many organizations rely heavily on detective controls. 

A lot of controls are detective in nature, so they tell you when something’s actually gone wrong rather than prevent the thing from going wrong in the first place. 

That doesn’t mean detective controls aren’t important, but organizations should be asking whether they are investing enough effort in prevention. 

We should also be asking harder questions about the overall cost of controls. 

Are controls effective? 

Are they proportionate? 

Can they be optimized? 

Can technology help us automate repetitive activities? 

Those are important conversations because controls consume time, money and resources. We shouldn’t assume more controls automatically creates better risk management. 

The impact of Consumer Duty 

Lucy 

How has Consumer Duty changed risk and compliance in practice? 

Rebecca 

It has definitely raised the bar. 

Consumer Duty has encouraged organizations to look beyond simple compliance with rules and focus more heavily on customer outcomes. 

That requires stronger governance, better reporting and greater evidence that firms are delivering the right outcomes for customers. 

We’ve seen a lot of useful publications and examples from the FCA showing both good practice and areas for improvement. 

For risk teams, that means continually evaluating how effectively they’re monitoring outcomes and supporting the business. 

Building influence as a risk leader 

Lucy 

What makes someone successful in risk? 

Rebecca 

Technical expertise matters, but it’s only part of the job. 

You need strong relationships. 

You need credibility. 

You need commercial awareness. 

And you need to be able to communicate risk in a way that stakeholders understand. 

The best risk professionals don’t simply identify problems. They help leaders navigate uncertainty and make better decisions. 

That often means balancing challenge with collaboration. 

The future of risk management 

Lucy 

What do you see as the biggest opportunities for the profession over the next few years? 

Rebecca 

Technology will continue to play an increasingly important role. 

AI, automation and better data will help risk functions become more efficient and more insightful. 

But I don’t think technology changes the fundamentals. 

Organizations will still need people who can understand the business, exercise judgment, challenge assumptions and help leaders make decisions. 

The future of risk isn’t just about better tools. 

It’s about helping businesses achieve their objectives in a safer, smarter and more effective way. 

Advice for future risk leaders 

Lucy 

What advice would you give to someone building a career in GRC? 

Rebecca 

Take opportunities to understand different parts of the business. 

Build relationships. 

Stay curious. 

Develop commercial awareness alongside technical expertise. 

And don’t underestimate the value of understanding how decisions are actually made inside an organization. 

The most effective risk professionals are the ones who can connect risk to business outcomes. 

Lucy 

Rebecca, thank you for joining us. 

And thank you to everyone listening to Spotlight on Women in GRC. Join us next time for another conversation with the women shaping the future of governance, risk and compliance.