Health care risk and compliance (R&C) functions are ready for the next phase of their evolution. Over the past decade, many functions have built a strong foundation for business partnerships by embedding compliance earlier in decision making, adopting digital tools, and fostering a stronger culture of accountability. Now, R&C must evolve again to adapt to new digital and AI business models, a faster pace of change, and expanding engagement with practitioners and patients.
R&C functions can build on past successes by advancing to true two-way collaboration with business colleagues: integrating risk thinking into strategy, operations, and innovation. Enabled by analytics, AI, and new talent models, R&C functions can fulfill the long-discussed promise of integrated risk management.
Collaborative Risk Management Is a Two-Way Partnership
Health care R&C leaders have made progress in building relationships with their business counterparts. As risks multiply across functions, business leaders must reciprocate by integrating risk thinking into everyday decision making.
In practice, two-way collaboration means that functions with delegated accountability—such as R&D, commercial, operations, and IT—monitor and report their key risks, while R&C synthesizes and builds upon those inputs to create a single, enterprise-wide view. (See Exhibit 1.) Together, leaders prioritize the two or three most material risks to be tracked and managed at the corporate level. R&C acts as the integrator and facilitator of this dialogue, bringing transparency, aligning mitigation strategies, and maintaining focus on the most important issues.
Digital Analytics and AI Are Catalysts
Digital analytics and AI are essential to driving collaboration, creating real-time transparency, and generating shared insights. By identifying risk and disruption patterns early, they enable R&C teams to move from hindsight to foresight and coordinate proactive responses across the enterprise.
AI-powered analytics can transform the daily work of compliance professionals. Risk-based sampling and anomaly detection help teams focus on the most material risks instead of manually reviewing thousands of transactions, while automated third-party monitoring uncovers issues in vast supplier networks that might otherwise go unnoticed. These capabilities make risk management both more efficient and more strategic, directing human attention to where it matters most.
But technology alone is not enough. Its power is realized only when paired with human expertise and judgment. Advanced tools can analyze millions of records and flag potential issues, but experienced professionals must interpret the context, assess intent, and decide on the right response.
The combination of machine intelligence and human insight creates a learning loop that strengthens compliance performance and business resilience. Used this way, digital analytics and AI become not just enablers of collaboration but catalysts for a smarter, more connected risk culture.
Stay ahead with BCG insights on risk management and compliance
Talent and Operational Models Drive Impact
Implementing collaborative risk management powered by analytics and AI requires more than new tools. It calls for new skills, mindsets, and structures. (See Exhibit 2.) Today’s R&C professionals blend business acumen and relationship skills with analytical and digital fluency. They interpret complex data, translate insights into action, and collaborate across functions to shape outcomes rather than review them after the fact. Relationship building and influence are as critical as technical expertise, ensuring that R&C is embedded in decision making from the start.
Across the industry, leading health care companies are redesigning how R&C operates. Many are moving to hub-and-spoke models or centers of excellence that unite digital, legal, and risk capabilities, balancing efficiency with agility and enabling solutions tailored to local needs.
Digitization frees up capacity so that R&C teams can focus with business leaders on emerging challenges instead of merely tracking risks. In an era of automation and advanced analytics, business leaders will question the size and scope of R&C functions that do not adequately support them.
The Strategic Benefits Are Tangible
Collaborative risk management builds confidence among investors, regulators, and patients in a company’s commitment to safety and efficacy and its ability to remain resilient and compliant despite accelerating change. This trust can translate into smoother regulatory reviews, a stronger market reputation, and greater consumer loyalty. R&C functions provide proactive oversight while business teams gain a clearer understanding of risks and their impact. The benefits are achieved in several ways:
- Transparency fosters accountability. Companies gain a comprehensive view of their most critical risks, allowing them to prioritize high-impact initiatives and align investments with market needs. Education across control functions fosters risk awareness and a stronger culture of accountability.
- Empowerment improves performance. With the right frameworks and monitoring tools, business leaders can make faster, better-informed decisions. This not only safeguards against potential pitfalls but also promotes innovation, efficiency, and competitiveness.
- Data access promotes compliance. Advanced data aggregation enables proactive risk identification across functions. Data-driven systems ensure compliance by tracking global regulatory requirements and updating processes as rules evolve.
- Analytics strengthen agility and trust. A shared analytics platform enhances reporting and decision making. Real-time insights help organizations adapt quickly to regulatory and market shifts, strengthening credibility with regulators and confidence among stakeholders.
Five Imperatives for Enabling Two-Way Collaboration
To realize the benefits of two-way collaboration, R&C and business leaders should follow five imperatives:
- Be ambitious in scope and impact. Expand the role of R&C teams beyond compliance assurance so they can serve as trusted business enablers who support innovation, growth, and long-term value creation. Build governance models that encourage R&C and business leaders to jointly own risk outcomes.
- Use advanced analytics for proactive risk management. Apply data-driven techniques to detect early risk signals, prioritize material issues, and reduce noise, enabling teams to focus on what truly matters.
- Leverage cross-functional expertise to build digital tools. Draw on talent within and outside of the R&C function to design and deploy digital tools that automate manual tasks, streamline workflows, and enhance transparency.
- Nurture the right talent. Develop and invest in professionals who understand both the business imperatives and the risks associated with them. The right talent can help the business pursue its objectives while managing risk exposure.
- Right-size the R&C function. Continuously assess the function’s capacity and structure to ensure it is fit for purpose. Optimize resources to enhance efficiency and proactively update the operating model before external pressures demand it.
Health care R&C functions must build on their progress to shape the next chapter of risk management. By deepening collaboration, harnessing digital analytics and AI, and evolving talent and operating models, organizations can anticipate risks, strengthen trust, and accelerate innovation. Those that lead will redefine R&C as a strategic partner in growth and resilience—helping the health care industry navigate complexity and create lasting value.
The authors thank their BCG colleagues Natalia Alvarez, Sunaina Kirpalani, Anusha Mehta, and Kritika Rai for contributions to this article.
