Risk management is no longer a supporting compliance activity for AFSLs and ACLs. As cyber threats, AI adoption, outsourcing, financial crime and consumer harm risks converge, licensees must be able to demonstrate that controls operate effectively in practice. This article examines the 2026–2027 risk outlook, ASIC's enforcement priorities, and the practical steps advisers, AFSLs and ACLs should take to strengthen governance, evidence and operational resilience.