---

Key Takeaways from the November 2026 ProSight Audit & Risk Conference

by Ardmore Banking Advisors

ProSight (formerly RMA) recently held its annual Audit and Risk Conference, bringing together chief credit and risk officers, AI practice leaders, model risk and compliance executives, regulatory advisors, and economists to discuss what lies ahead for banking in 2027 and beyond. Although most panelists came from the nation’s largest institutions, their messages apply just as directly to community and midsized banks, and often more so, because smaller institutions have fewer resources and less room for error. Four themes ran through nearly every session: managing risk in volatile times, the rapid arrival of artificial intelligence, a fundamentally changed regulatory posture, and continued disruption to the traditional banking model. Here are the takeaways we believe matter most to bankers today.

Managing Credit Risk in Volatile Times

The Chief Credit Officers panel suggested that today’s credit picture is better than the headlines suggest. Panelists described a largely benign credit environment: delinquencies and non-accruals are down, unemployment is stable, and consumers, while gloomy in sentiment, are still paying their bills. Yet no one believes that the credit cycle has run its course. The economic backdrop remains unsettled, with persistent inflation, tariffs and supply-chain deglobalization, rising sovereign debt that keeps upward pressure on rates, and the possibility of low-probability, high-impact events such as a sharp market correction. Credit problems can surface quickly, which makes early warning capability essential today.

Commercial real estate remains the area to watch. Bank CRE leaders still rank office as the riskiest sector, particularly anything below Class A, but most believe banks have already absorbed the bulk of office losses. Attention has shifted to multifamily, where most banks carry significant construction and permanent exposure. New supply is weighing on Sun Belt markets, rent growth is lagging. Underwriting assumptions do not reflect expenses climbing, and construction projects underwritten using stabilized NOI are coming in lower. Cap rates have been surprisingly resilient but are beginning to rise. There is also potential concern rising in the hospitality sector, due to rising labor costs, and student housing, due to an expected ‘enrollment cliff,’ as the lowered birth rates over the past 18 years following the Great Recession will begin to show impact.

Suzanne Storm, Ardmore’s Senior VP of Credit Policy & Risk Management agrees, and adds that geography needs to be considered as well.  “Some markets have struggled more than others,” she says.  “Washington, DC, for example has displayed excessive vacancy and falling values across most asset classes – especially in office and multifamily. Rent-stabilized multifamily properties in New York City and other metro areas are also very challenged.”  

Concerns were also raised about stress in junior liens, borrowers refinancing by debt funds that expect to be repaid through a sale rather than a refinance, and government funded projects. “Portions of portfolios that are reliant on government bonds or funding for refinance have seen that market struggle, extending the banks’ exposure,” says Suzanne.  

The practical advice at the conference was consistent. Watch for early warning signs: a drop-off in borrower communication, deferred maintenance, rent rolls that don’t match what you see on site. Also be aware of upcoming rate resets, maturities, and lease expirations. Manage concentrations not only by property type and geography but by sponsor and even by tenant. Conduct refinance readiness reviews that plan for plausible scenarios, because the era of “extend and pretend” is ending. And make better use of stress testing; the consensus was that most lenders aren’t doing enough of it or aren’t using the results to inform decisions.

There was also concern raised over the need to cultivate new credit talent and the fact that most of today’s lenders and credit officers have never worked through a real downturn, while retirements are draining experience from credit departments. Several banks are using job rotations and case-study training to rebuild that judgment before it is needed.

Artificial Intelligence: From Experimentation to Governance

AI dominated the agenda. One chief credit officer observed that there is no part of the credit process AI cannot touch, from appraisal review and policy checks to credit approval and portfolio monitoring. Large banks are using it to remove repetitive manual work so employees can operate “at the top of their license” and spend more time with clients. But every panel returned to the same point: AI success depends far less on the technology than on data quality, governance, and people.

Several governance lessons stood out. First, know what you have: maintain an inventory of AI use cases with their owners, controls, and risks, including AI embedded in vendor products, which many banks overlook. Second, calibrate controls to risk. A chatbot is not an autonomous AI agent, and treating every project the same either overburdens low-risk tools or under-controls high-risk ones. Third, explainability should be increased with materiality; a credit or fraud decision demands a clear account of which factors were used and which were deliberately excluded. Fourth, a “human in the loop” only works if it is the right human, with the expertise to challenge the output. That matters because AI results usually look reasonable even when they are wrong. As one panelist noted, a person won’t give ten correct answers and then hallucinate the eleventh, but an AI model can.

Panelists also warned against two opposite mistakes. Overly restrictive policies push employees toward “shadow AI,” unapproved tools used outside the bank’s controls. Some institutions have already found customer personal information entered into public chat applications. On the other extreme, some banks believe that recent regulatory statements exempt AI from model risk management. But they don’t remove the bank’s responsibility to monitor and validate the tools it uses and the risk it creates.

Expect a learning curve and slow near-term returns. The Vice Dean of the Wharton School described a “J-curve” common to major technology investments: productivity often dips while old and new systems run side by side and staff learn the new tools, before returns eventually exceed what came before. Selective implementation and early investment in training can shorten that dip. For smaller banks, the encouraging news is that established vendors now offer AI capabilities, reducing reliance on unproven start-ups. The recommended starting points work at any size: educate the board and executive team first, focus on use cases with clear economics, name an AI champion in each business line, and share what works across the organization.

The State of M&A

M&A activity was lighter than expected this year due to economic uncertainty, rising interest rates and lagging stock values. However, the midterm elections, held during the conference, may signal a pendulum swing in the next presidential election that could spur new urgency to act over the next two years as banks look to close deals before the rules change.  

““Community bank M&A activity remains relatively slow despite a more favorable regulatory environment and growing interest in consolidation, says Todd Sardich, Ardmore’s Executive VP of Risk Management & Senior Director of Consulting.  “Valuation gaps, credit quality concerns, and earnings uncertainty continue to limit transactions.”

The current top drivers in M&A activity include attaining the scale to spread rising technology costs, adding new capabilities in digital payments and AI, and growth for banks in slow-growing markets.  “While the underlying drivers of consolidation remain strong, buyers are selective and sellers remain hesitant, suggesting a more gradual pace rather than a surge in activity,” says Todd.  

Whether bankers are looking to buy or sell, the conference stressed the need to act now in planning for transition and implementation challenges, including staffing and culture fit. Transactions now move faster than ever, and talent retention is critical because departing bankers often take customers with them. Best practice is to know your own bank’s strengths and vulnerabilities, and have playbooks ready, including integration and changing management plans, so you can act when the right partner appears. Those banks that have been sitting on the sidelines are likely to move while the current administration is in control.

The New Regulatory Regime

The regulatory landscape has changed quickly. Advisors described a reshaped CAMELS framework that de-emphasizes management and reputational risk and centers on material financial risk. Matters Requiring Attention (MRA’s) are now tied to materiality; lesser findings may become “regulatory observations,” with their severity largely left to management to interpret. MRAs increasingly address single issues rather than bundles, giving banks less insight into examiner thinking. Agencies are downsizing, exams are fewer, and the OCC, Federal Reserve, and FDIC are not always issuing their guidance together. Meanwhile, state regulators are not necessarily following the federal lead and are developing their own frameworks, including for AI.

Updated model risk guidance puts new emphasis on materiality, scaling governance to the size of the risk, and notably leaves generative AI out of scope. Panelists read that as a deliberate effort not to stifle innovation and acknowledge that’s it’s a tricky tightrope to walk. For now, banks can apply their existing model risk and third-party risk frameworks, but they must document and justify their approach.

The central message: lighter regulation shifts the burden of proof onto management and the board. One presenter compared it to seat belts. If the law requiring them disappeared, sensible drivers would keep buckling up. Examiners will still test a bank’s systems, policies, and practices. Small weaknesses in credit, operational, or compliance risk need attention before they become material. The panel’s biggest concern was that banks may drift toward the “regulatory minimum” rather than managing to their own risk appetite, just as the regulatory pendulum may eventually swing back. Their advice: define regulatory terms such as “material financial risk” for your own institution and be prepared to show your work.

“For the most part, banks welcomed the declared end of the ‘nit-picking’ era with regulators proclaiming that safety and soundness is what they will focus on,” says Storm. “This is a welcome shift of attention, though Ardmore would remind banks that good processes remain essential for management of portfolio risks.”

Fintech’s and the Disruption of the Banking Landscape

Fintech’s remain the largest competitive threat to banks, already holding roughly six percent of the payments market while typically being cheaper to use. They are increasingly obtaining bank charters, including industrial bank charters, to gain lower-cost funding and access to Federal payment rails. Cash usage continues to decline as digital payments grow. Looking ahead, a presentation by the Vice Dean of Wharton School of Business envisioned banks evolving by 2030 into trusted platforms that give customers safe access to a broad ecosystem of financial services, including partner fintechs. Banks can leverage their experience in governance and compliance as a distinctive advantage, and must use the public’s trust in them as an advantage over a growing list of non-bank competitors.

The Common Thread

Across every session, one message stood out: discipline matters most when the guardrails loosen. Credit is stable, but the cycle is not over. AI offers real gains, but it demands governance and experienced, skilled people. Regulators are stepping back, but they expect bank management to step up. For community and midsized banks, that points to clear priorities for 2027: sharpen early warning and stress testing practices, review CRE concentrations and upcoming maturities routinely, build an AI inventory and governance framework scaled to your institution, and make sure your board can demonstrate that credit risk is understood and controlled. Independent, objective credit review remains one of the most effective ways to provide that assurance.

---