By Penny Cagan, Part-Time Lecturer in the Enterprise Risk Management Program, School of Professional Studies; Senior Risk Advisor
I am privileged to teach Operational Risk in the Master of Science in Enterprise Risk Management (ERM) program at Columbia University. I spend a lot of time coaching students who are looking to get started in a risk management career and want to know how they can get their foot in the door. This work—teaching and coaching—is my way of giving back to a discipline that has inspired me and provided me with meaningful and challenging work.
When I am asked by my students to share the trajectory of my risk management career, I tell them not to look at how I managed through many regulatory and financial cycles, because the operating environment is changing rapidly. Of course, I am always happy to share my personal experience, but I tell my students that their career runways will likely look different than mine.
I held a global role in a large U.S. Big Four bank over 10 years ago where I was responsible for all global risk assessments. I had a traditional risk management resume. The person in that role today has a technology background, and his working experience has been primarily with technology companies. His mandate is to automate all risk assessments with the assistance of artificial intelligence. I am not necessarily advocating that financial institutions should look to technology companies for their future risk managers, but risk managers need to manage AI-related risks and effectively use AI—including agentic AI—in their risk management practices.
As I work through the Operational Risk material with my class this semester, I am stressing how our future risk leaders in my class need to start preparing for a changing risk environment. This requires adopting change in all its forms, as I would argue that it is the change carriers and champions that will be most successful in their careers. There is one thing that is clearer than ever—risk is not going away, and in fact is intensifying, and the next generation of risk leaders has an opportunity to do things differently.
First and foremost, they need to demonstrate that they are able and willing to embrace change. We are experiencing more rapid change than I have ever experienced (and I started my career gathering economic statistics through calling government analysts in Washington). And although I tell my students that their careers will likely look different from mine, the one thing I can share is that I embraced every technology that came along, including online econometric databases that freed me from those calls to Washington.
And while the discipline of risk is moving toward more focus on resilience and outcomes, future risk managers need to be equally resilient and out-come based. This is more critical than ever because while the regulatory landscape might be easing up, risks are more complex, interconnected, and operating at greater velocity than ever before. Climate-related events, cyber threats, third-party concentration in cloud services, fraud enabled by advanced technologies, and geopolitical instability all create stress points that can challenge a firm’s ability to be resilient. And it calls for risk leaders who themselves are resilient.
I see those leaders in my classroom with their varied backgrounds and interests. They are generally passionate about identifying emerging risks and brainstorming risk management responses. I am fortunate to be on the front lines preparing my students for operating in this complex and evolving climate. I am happy to share what I have learned through decades of risk work with them but know that their careers will look fundamentally different from my own.
While my students’ career paths will look very different from my own, the underlying principle holds: Embrace change, learn continuously, and stay intellectually curious.
Views and opinions expressed here are those of the authors, and do not necessarily reflect the official position of Columbia School of Professional Studies or Columbia University.
About the Program
The Master of Science in Enterprise Risk Management (ERM) program at Columbia University prepares graduates to inform better risk-reward decisions by providing a complete, robust, and integrated picture of both upside and downside volatility across an entire enterprise. For both the full-time and part-time options, students may take all their courses on Columbia’s New York City campus or choose the synchronous online class experience.
The application deadline for the M.S. in Enterprise Risk Management program is May 1. Learn more about the program here.
