Data, cyber and model risk top IT concerns for risk managers: survey

Data quality, cyber risk and the complexity and black-box nature of models were voted as the top three technology concerns for energy risk managers in a recent survey by Energy Risk. 

The survey, which was live throughout January 2026, polled 50 risk professionals about their energy and commodity trading and risk management (E/CTRM) systems landscape, asking about future plans and greatest concerns. Over 58% of respondents said their biggest IT concern was data quality, while more than 47% cited cyber risk and 39% pointed to model complexity (see table 1).

The increasing complexity of energy markets and the move to more granular intraday trading in power markets has increased the need for quality data and modelling in recent years. The Middle East conflict and the resulting oil and gas price volatility is only likely to have increased the emphasis on data since the survey, say analysts. 

Crisis events often cause firms to reflect not just on the quality of their data but on their entire E/CTRM system landscape, surfacing issues that had been lurking but suddenly become more problematic, says Ken Twomey, global advisory practice lead at capSpire.

“[Extreme volatility] uncovers the real pain points and problems that companies have,” he says. 

A lack of visibility into risk and exposure, for example, can become extremely painful during periods of volatility. “Certain companies don’t have the visibility of their risk, their exposure and sometimes even of their positions to react to volatility in time – either by protecting value or by taking advantage of the moves in the market,” he adds. 

[Extreme volatility] uncovers the real pain points and problems that companies have

Ken Twomey, capSpire

A reliance on batch-based, end of day, t-plus-one scenarios is not fit for purpose when oil prices move $20 in a day, he notes. As a result, Twomey foresees an increased focus on architecture and identifying when the processes that feed into risk numbers are not up to par.

In the survey, which took place before the outbreak of the Iran-US war and the resulting energy price volatility, more than a fifth (22.7%) of respondents said increased price volatility was driving their organisation to make changes to its E/CTRM landscape. Volatility is even more likely to be a driving factor now, say analysts (see table 2).

Periods of volatility, however, can create a dilemma for firms when it comes to investing in IT infrastructure. “Due to the increased volatility, you’re more hesitant to invest but, at the same time, it brings to the surface what you’re lacking,” says Yefreed Ditta, director of consulting at Value Creed. “For instance, you might realise that you cannot get an up-to-date position in a timely manner because of the legacy technology you have. And then the question is: do I tackle this straight away because I expect this to continue and really need to monitor risk better, or do I wait until the dust settles?”

Making changes doesn’t have to involve an overhaul of your entire E/CTRM system, notes Twomey, adding that some capSpire clients are now using advanced risk platforms that bolt on to an existing E/CTRM system. “They’re starting to do more complex or more real-time risk [management] outside the E/CTRM, and using more best-of-breed technologies for that.”

Adding best-of-breed systems to an existing E/CTRM landscape can address many common system pain points. The most common criticisms of existing systems as listed by respondents to the survey were restricted coverage/lack of functionality (42.9%), poor or slow performance (40%) and lack of flexibility to add or remove functionality (31.4%). (See table 3.) 

The factors driving firms to make changes to their E/CTRM landscape were listed as business growth (50%) – which could involve moving into new markets – increased market complexity (45.5%) and derivatives or other financial regulation (40.9%). (See table 2.) 

When it comes to what firms hope to achieve by making changes to their E/CTRMs, the top choice, garnering 75% of respondents’ votes was to increase operational efficiency, while 70% wanted to boost risk management capabilities (see table 4). Meanwhile, 51% wanted to achieve cost reductions and lower IT overheads. 

When asked what improvements firms would like to make to their E/CTRM systems capabilities this year, the top answer was to increase automation (see figure 5).

Twomey says clients often feel systems are too manual and batch-based, whereas they’d like data streaming capabilities to support real-time trading. “This goes back to risk visibility,” he says. “These companies are moving to a place where they need the data to make decisions much faster and the systems just aren’t supporting that, they’re too manual.”

An AI-fuelled E/CTRM boost

Of course, companies looking to capitalise on the reams of data available to market participants these days can use artificial intelligence to parse and process large volumes of information. While organisations are clearly interested in using more sophisticated data and analytics tools, the survey shows some reluctance among energy companies when it comes to AI in particular. According to 29.7% of respondents, for example, deploying AI is a major IT challenge for trading and risk (see table 6).

Some 34.9% of survey respondents are targeting analytics improvements without AI over the next year, versus only 18.6% that want to use AI in this area. When it comes to improving data collection and cleaning, 20.9% want to make improvements in this area without AI, whereas 16.3% plan to use AI to do the same thing. Only 9.3% currently plan to implement AI in other processes, which includes “test and storage optimisation” and “new commodities products”, according to the survey (see table 5).

This could explain why issues around AI, such as missing out on opportunities, or losing staff, came lower down the list of IT concerns for the risk manager (see table 1).

“Companies will be at different places on their data journey, but a lot of investment has been put into centralising data and cleaning it up. Now, these firms need to see the value from the data,” Twomey says. This value could come from simple reporting upgrades, but it could also come from more advanced AI-fuelled capabilities – whether that’s in terms of machine-learning, model-based techniques or more advanced agentic AI tools.

“I think companies are still struggling here,” Twomey adds. “They’re not really surfacing that data in a co-ordinated, clean way yet and allowing their teams to just use it. The bar I’d be shooting at as an organisation would be to really empower everyone to use this data that’s now available.” 

Finding use cases for AI

“If you want to [benefit from] big data, the most efficient way to do that, is by automating processes,” says Tolu Ayoola, senior vice-president, advisory services, at KWA Analytics. He adds that early-stage use cases for AI typically focus on automation. And the survey shows that 67.4% of respondents plan to increase automation this year as part of their planned E/CTRM improvements (see table 5).

Ditta advises taking a step back first to determine which systems and processes work, and which could be improved by automation. Connecting systems to eradicate the need for manual transfers is one simple AI use case that often emerges from this exercise, he says. And cost is a big driver, particularly in relation to using AI to create efficiencies. “Typically, the first use case is automating so less people are required to move things from system A to system B, or to generate documents such as invoices.”

But companies should consider what they would do if they had more developers, Ditta says. “Think: ‘what if I had an infinite pool of developers? What would I like to develop?’ And then, even if you only have five developers, aided by these tools, those five can act like hundreds,” he says. “Most companies are looking at AI to read documents and extract data, for example, but there are so many other things that you could do with AI.” 

If you want to [benefit from] big data, the most efficient way to do that, is by automating processes

Tolu Ayoola, KWA Analytics

Ditta argues that, as people see the benefits of AI-driven tools in their everyday lives, they’re increasingly keen to see how it can change their working lives too. “However, there is definitely a component of naivety,” he adds. “It’s like people want magic to happen.” 

And Ayoola warns that disappointment with the results of early AI use cases can discourage further experimentation. “In some cases, organisations are not seeing the expected timeline for both deployment and measurable value,” he says. “It’s not like a new piece of software you can just install and see the value; you have to change the mindset, and you have to feed it data.” 

Difficulties identifying front-office use cases during the early stages of AI development can arise from a disconnect between risk or trading teams and technology or AI teams. “Many trading or risk management teams lack the specialised training needed to translate AI concepts into practical use cases,” Ayoola says. “So, you need a liaison that can translate those use cases and then work with the AI team to develop and test before bringing it into the trading platform.” 

Indeed, the survey results show that the biggest IT challenge for E/CTRM users is understanding what new technologies are available and applicable. Almost 65% of respondents listed this as their biggest IT challenge. This was followed by understanding what competitors are doing (38%), while deploying AI came in as the third biggest challenge (see table 6).

Reaching for the cloud

Similar concerns may also affect cloud adoption among energy and commodity companies. While nearly half (48.6%) of respondents said their E/CTRM systems are fully in the cloud, 27% still have no cloud-based E/CTRM applications at all and 24% have some functions in the cloud. 

The question of whether to go fully cloud-based or not often depends on the maturity of an organisation’s IT infrastructure, Twomey says. “If you’re relying on spreadsheet-based processes, your desire to move to the cloud is probably going to be diminished. And if you’re doing a lot of in-house, ad hoc things, you are going to want to stay out of the cloud as well because it’s all there on your desktop,” he says. “Further, there are companies with legacy system architecture that isn’t cloud-ready or cloud-native or even supported in the cloud. And then there is a bit of trepidation over [events such as] the CrowdStrike issue, which have maybe [encouraged] people to pull back.”

In some cases, organisations are not seeing the expected timeline for both deployment and measurable value. It’s not like a new piece of software you can just install and see the value; you have to change the mindset, and you have to feed it data

Tolu Ayoola, KWA Analytics

Ditta agrees that high-profile cloud-related data events haven’t helped the case for moving to the cloud for some companies. “There was a wave of going cloud-first but, after these events, I have actually seen examples of companies reversing that decision and deciding to stay on-premise or private clouds so they can have better control,” he says.  

But Ayoola adds that cloud adoption could accelerate as more organisations modernise their technology systems. “For the 27% that remain fully off-cloud, perhaps it’s because the system they rely on is a highly customised legacy application,” he says. “Or it could be due to outdated underlying technologies or architecture, or unresolved security and compliance concerns.”

E/CTRM budget planning

Making any E/CTRM change, whether it’s AI-related or a move to the cloud, requires resources. Some 50% of respondents said their 2026 IT budget is unchanged from last year, with 36% saying it’s bigger and 14% saying they are dealing with a smaller budget. Just under a third of respondents listed lack of IT budget as a major IT issue right now. 

This aligns with results elsewhere in the survey that reveal many companies have no plans to change their E/CTRM systems this year. “In the current environment of supply-chain disruption, political uncertainty and economic pressures like inflation, interest rates and so on – those issues materially shape budget decisions,” says Ayoola. “And these dynamics will continue to influence expenditure and capital allocation priorities. When you have uncertainty, especially if the system has been recently upgraded, it makes sense that 50% would stick with the same budget.” 

Of course, companies may revisit these budget plans, especially if significant market volatility continues, revealing pain points in their systems. Alternatively, after the dust settles following this period, companies may see a need to address any issues that the period has highlighted when it comes to trading and risk management capabilities. 

“Given the change in the competitive landscape and the volatility that’s going on, I would expect this to start turning into more companies looking for a bigger structural change,” says Twomey. He estimates that this may start to happen in six to 18 months if the geopolitical unrest starts to calm.