Key takeaways

Control library practice discussions

An exploration of current control practices across financial services

Service

ORX Membership

Community

Risk and Resilience

Risk programme

Risk Management

Sections

Key takeaways - July 2025

Between 2021-2022, ORX developed an industry-first Reference Control Library. Built using data from 50 members, this sets out the typical controls the industry uses to manage each of the risks in the ORX Reference Risk Taxonomy.

As part of this work, we extensively examined industry practices around this topic, culminating in the publication of our Controls Practices Paper. At the time, we found that despite strong appetite to standardise and automate the control environment, for many organisations, control library developments were in their infancy.

Against the background of an external environment characterised by increased volatility, third-party reliance, fast-paced technological developments and wide-reaching regulatory change, we felt that now is a good time to revisit the topic. ORX members can log in to read the findings.

In July 2025, we brought together representatives from over 30 firms to share their current control practices. Discussions centred primarily around the following topics:

Control library development progress and challenges
- Control governance, size and structure of libraries
- Use of AI to enable library development
The concept of key controls

It was clear from the discussions as well as wider conversations with the community that there is appetite to explore the wider topic of controls in further detail going forward. Key findings from the discussions will be incorporated into future work on the wider topic. In the meantime, we have explored some of the main headlines from the discussion below.