Across the industry, controls have moved firmly up the agenda.
Recent ORX forums, member conversations and research all point to the same reality. Firms are no longer debating whether controls matter, but how to make them more effective, more dynamic and more defensible in an increasingly complex risk environment.
In this blog, we explore some of the key themes from the recent ORX report, Controls practices: Trends, insights and industry progress, and the accompanying ORX Podcast discussion, looking at how firms are evolving their approaches to controls, monitoring and control libraries, including the growing role of the ORX Reference Control Library.
Getting the foundations right
For many firms, the past few years have focused less on innovation and more on discipline. Before firms can move towards more predictive, automated and real-time approaches to control management, many are still trying to solve some fundamental issues around consistency, ownership and visibility.
One of the clearest emerging themes is the amount of effort firms have invested in bringing control data together at a central level, often for the first time. Controls that previously sat across fragmented inventories and business lines are now being consolidated, rationalised and standardised.
In practice, much of this work has been deliberately unglamorous. Firms talked about:
- Removing duplicate controls
- Driving more consistent and better quality control descriptions
- Distinguishing more clearly between controls and other activities and processes
- Establishing a greater understanding of control definitions across the organisation
Several firms also noted that AI and automation are increasingly being used to accelerate this work, particularly when refining control descriptions, improving consistency and reducing manual effort.
The result is that firms have laid a solid foundation for creating more effective control libraries.
Why control libraries matter more now
Control libraries are no longer viewed simply as documentation exercises or compliance artefacts. Increasingly, firms are using them to create a more structured and connected understanding of the control environment.
A recurring challenge discussed throughout the ORX research was that controls, indicators, processes and resilience mapping often evolve separately across teams and functions. Over time, this creates inconsistencies in language, structure and granularity that make frameworks harder to align and compare consistently.
Since the first publication of the ORX Reference Control Library, we’ve also seen a significant increase in the number of firms developing their own centralised control libraries. The original 2021/2022 ORX Controls Practices Paper found that only around a third of firms had established a central control library. In contrast, the latest ORX report, Controls practices: Trends, insights and industry progress, drawing on 2025 discussions, survey findings and follow-up roundtables, found that 80% of firms either have a control library in place, are actively developing one, or plan to establish one in the near future.
As control frameworks become more connected and data-driven, many firms are increasingly looking to external reference structures and libraries to support greater consistency across the broader control framework. This is why the ORX Reference Control Library was developed using member data and practitioner insight to help firms create more aligned and effective control frameworks.
34
global financial institutions participating in this paper
80%
of firms have developed or are developing a central control library
From static reviews to real-time insight
With stronger foundations now in place, many firms are turning their attention toward making control monitoring more dynamic.
Around 70% of firms involved in our research reported active work to enhance real-time monitoring capabilities. Traditional approaches based on periodic assessments and manual testing are increasingly seen as insufficient for the pace and complexity of today’s risk environment.
Current initiatives include:
- Enhanced control indicators and dashboard monitoring
- Automated control testing
- Real-time feeds from automated controls
- Experimentation with AI-enabled monitoring capabilities
Underlying all of this is a broader shift in how firms think about controls. Increasingly, firms are trying to use control data to generate earlier insight, support better decision-making and build a more complete picture of operational risk.
At the same time, firms are connecting controls more closely to operational resilience programmes, end-to-end processes, regulatory obligations and external loss data to create a more integrated view of risk across the organisation.
Where firms are heading next
Taken together, the findings point to a clear direction of travel across the industry. Firms are moving away from fragmented inventories and static frameworks toward more connected, integrated and insight-driven approaches to control management.
It is against this backdrop that we began refreshing the ORX Reference Control Library, once again drawing on member data and practitioner insight to create an updated, industry-aligned framework.
As with the wider ORX Reference Libraries spanning controls, indicators, processes and services, the objective is not to prescribe how firms should operate, but to provide a credible external reference point that supports greater consistency, comparability and defensibility across operational risk frameworks.
For many firms, the question is no longer whether to evolve their control framework, but how confident they are that their controls reflect current risk exposure rather than historical design choices.
How to access the library
The ORX Reference Control Library is available free to ORX members and also for non-member institutions to purchase on the ORX website.
