Risk Consulting Services

This category's evaluation is genuinely still ahead of us. Forrester says a landscape report and Wave will arrive in 2026 and early 2027, roughly sixteen years after the last scorecard that came anywhere close. The market those future evaluations will grade is being reinvented in public right now, by AI, and the reinvention is the story to read while the Wave is pending.

The planned evaluation and its sixteen-year gap

VP, principal analyst Paul McKay announced the coverage plan on October 24, 2025, launching a new research area for risk consulting services built on a report called An Anatomy Of Risk Consulting Services, with the landscape and Wave evaluations to follow in 2026 and early 2027.

The last Forrester Wave in this neighborhood ran in 2009, when PricewaterhouseCoopers was named a Leader in Information Security and IT Risk Consulting, recognized for its large global practice, pragmatic solutions, and its ability to connect IT risk assessment through to implementation. Sixteen years without a dedicated scorecard is the longest gap this series of articles has recorded, and the gap itself is evidence: risk consulting was a settled market of audit-adjacent engagements, and settled markets do not get new scorecards.

The 2009 citation's language is a time capsule worth keeping. Pragmatic solutions, connecting assessment to implementation: the vocabulary of an era when the risk consulting product was a well-run engagement. The 2026-era vocabulary is already different, automated controls testing, managed risk services, owned software platforms, and the distance between the two vocabularies is what sixteen years of dormancy bought.

The market is not settled anymore, and McKay's blog says why.

The AI disruption the Wave will have to score

McKay's framing is the most candid disruption note in recent Forrester coverage: "one of the most significant changes I've witnessed." Consulting firms are reinventing their delivery models, and most are already using AI to "automate much of the drudgery of controls testing and assurance work."

The drudgery has a headcount. McKay cites a global bank with more than two thousand five hundred people whose main job is manual risk and control assessment. When AI automates the drudgery, those roles do not disappear, they reprice, and the consulting firms' business model, billing hours against manual assessment, re-prices with them.

The projected shape of the change is explicit: professional judgment over routine tasks, and "a seismic shift over the next five years in how risk consulting firms shape their services." Some firms may begin offering technology-driven managed risk services, consulting firms becoming recurring-revenue software operators, and CROs will favor partners that challenge the status quo with different skills and delivery models.

The Wave, when it arrives, will have to score a market whose biggest firms are halfway through a business model migration, which is why the planned status is the honest status.

The definitional question the future Wave must settle is visible in advance. If some firms become technology-driven managed risk service operators, the evaluation must decide what it is scoring: hours of expert judgment, a software platform, or a hybrid. The 2009 edition could assume the answer, consultants sell hours. The 2027 edition cannot, and the criteria design will itself be a market prediction, which is why the coverage announcement's framing, delivery model reinvention, matters more than any placement the future Wave will eventually produce.

The productization evidence already on the board

The migration is not hypothetical. The adjacent scorecards already show consulting firms operating as software vendors.

KPMG took a Leader placement in The Forrester Wave: Cyber Risk Quantification Solutions, Q2 2025, with its Cyber Risk Insights product, and the report noted KPMG was the only major professional services firm offering its own full-featured quantification solution, praised for model transparency, scenario scoping, and benchmarking.

The same pattern shows in cybersecurity consulting. KPMG led the Cybersecurity Consulting Services In Europe Wave, Q4 2025, on its Six Pillars framework and the Cyber Risk Insights SaaS product, and EY took a Leader placement in the Cybersecurity Consulting Services Wave, Q1 2026.

The risk consulting Wave will grade the same firms, and the productization pattern, consultancy plus owned software, is the strongest predictor of how its tier table will be shaped.

The honest state of this category

No Wave exists yet, and this article does not pretend otherwise. What exists is the coverage announcement, the anatomy report, the adjacent scorecards, and the public evidence of an industry mid-reinvention.

A buyer shopping risk consulting services today is shopping a market whose delivery model is changing faster than its contracts. The evaluation, when it lands, will be the first scorecard of the post-drudgery era, and every engagement signed before it lands will be benchmarked against it after. That timing is the buyer's leverage and the buyer's risk in the same sentence.

Three questions while the Wave is pending

How much of the engagement is automated, and how is it priced? The drudgery is being automated, and the price should follow. Ask each firm what percentage of the controls testing is AI-run, and whether the fee reflects it, because the scorecard will eventually ask the same question.

Does the firm sell software or only hours? KPMG's CRQ product is the pattern to watch. A firm with its own software has a different incentive structure than a firm selling only billable time, and the difference shows in every recommendation.

What happens to your engagement team when the automation lands? The two thousand five hundred person manual assessment team is the industry's open question. Ask about the delivery model's trajectory over the contract term, and get the staffing commitments in writing.

Forrester does not endorse any vendor named here, and tier placement should not be read as a recommendation to buy.

A close neighbor in Forrester's own coverage is SAP Services, where this entire services market is being driven by a single deadline, the end of mainstream maintenance for SAP's older ERP system, and Forrester's scorecard grades the firms hired to migrate enterprises to the newer platform before the clock runs out.

The nearest existing coverage on this site is Governance, Risk, And Compliance Platforms: forrester has evaluated this market since 2007 and its 2026 verdict is that many platforms still require manual data entry. Nineteen years of reinvention and the core complaint has not moved.