Chief risk officers · the role
What does a chief risk officer do?
The short answer · updated
A chief risk officer (CRO) is the executive who owns how a company identifies, measures and controls the risks it takes. The chief risk officer sets the risk framework and appetite with the board, challenges the business on the risks in its plans, reports the principal risks to the board, and in a bank or insurer holds a regulated role.
What is a chief risk officer?
A chief risk officer is the senior executive responsible for the company’s risk management across every kind of risk: financial, operational, regulatory, technology, supplier and strategic.
The chief risk officer does not run those risks day to day, the business does; the job is to make sure they are understood, kept within what the board will accept, and reported honestly.
The seat is standard in banks, insurers and investment firms, and increasingly common in large companies in energy, infrastructure, healthcare and technology.
In a smaller company the same work often sits with the chief financial officer.
Watch the abbreviation.
CRO also stands for chief revenue officer, a sales and growth role.
What a chief risk officer is responsible for
Most risk functions are built on a recognised method.
ISO 31000 sets out principles and guidelines for risk management: identifying, analysing, evaluating, treating, monitoring and communicating risks across an organisation.
The chief risk officer turns that into the company’s own framework.
In practice:
- Risk appetite. Agreeing with the board how much risk, of which kinds, the company will accept in pursuit of its plan.
- The framework. The policies, registers, limits and controls that keep risks within that appetite.
- Challenge. Testing the risks in new products, markets, deals and investments before they are approved.
- Measurement. Stress tests, scenarios and the indicators that warn when a risk is growing.
- Reporting. Regular reports to the board and its risk or audit committee on the principal risks and how they are managed.
- Incidents. Making sure losses and near misses are recorded, investigated and learned from.
- Culture. Making it normal for managers to raise a risk early.
The rules a chief risk officer works within
In financial services the seat is regulated.
The FCA lists the chief risk officer among the senior management functions: the holder needs approval before starting and can be held accountable for a breach in their area if they did not take reasonable steps to prevent it.
In listed companies the board’s duties shape the role.
The UK Corporate Governance Code includes a section on audit, risk and internal control, and Provision 29 asks boards to make a declaration on the effectiveness of their material internal controls.
Every company that prepares a strategic report must describe the principal risks and uncertainties it faces.
The chief risk officer usually prepares the evidence behind both.
Chief risk officer vs CFO vs chief compliance officer vs internal audit
A chief risk officer owns the framework for all risks.
A chief financial officer owns the finances, and often financial risk where there is no CRO; see what a CFO does.
A chief compliance officer makes sure the firm follows the rules that apply to it; see what a chief compliance officer does.
Internal audit is separate again: it gives the board independent assurance that the risk and control framework works, and so reports to the audit committee rather than to the chief risk officer.
Fractional, interim and permanent chief risk officers
A permanent chief risk officer suits a firm whose regulator or board expects the seat to be filled at all times.
An interim chief risk officer covers a fixed period: a remediation, a regulatory review, a new framework, or a gap between appointments.
A fractional chief risk officer works part of the week, more often in a growing company outside financial services that needs a framework built and reported to the board.
Where the role is a senior management function, the regulator’s approval is needed whatever the contract, so build the approval into the timetable.
A fractional or interim chief risk officer working through their own company may fall within the off-payroll working rules (IR35).
Status turns on how the engagement runs in practice, and a medium or large client makes the determination.
Our IR35 guide sets out the tests.
How to hire a chief risk officer
Decide what the role owns that finance, compliance and internal audit do not, whether it will hold a regulated function, and its access to the board and its committees.
Independence matters: a chief risk officer who reports only to the people whose plans they challenge is in a weak position.
Test candidates on a risk they raised that the business did not want to hear.
The Institute of Risk Management offers recognised qualifications in enterprise risk management, though none is required by law.
We recruit fractional, interim, part-time, temporary and permanent executives, and non-executive directors.
For a risk brief we send a shortlist of 3–5, each with pay or day rate, availability and IR35 position set out, after our five-stage vetting.
To hire a chief risk officer, book a call and we will scope the seat with you.
Questions people ask
What does CRO stand for in risk?
Chief risk officer.
The same letters stand for chief revenue officer in sales-led companies; see what a chief revenue officer does.
Who does a chief risk officer report to?
Usually the chief executive, with direct access to the board’s risk or audit committee.
In some firms the role reports to the chief financial officer.
Does a chief risk officer need regulatory approval?
In an FCA-regulated firm where the role is a senior management function, yes: the FCA lists the chief risk officer among the functions that need approval before the holder starts.
What is the difference between a chief risk officer and a chief compliance officer?
A chief risk officer owns the framework for every risk the firm takes; a chief compliance officer makes sure it follows the rules that apply to it.
Can a chief risk officer work part-time?
Yes, in a company where the seat is not a regulated function, or alongside an approved holder.
A fractional chief risk officer often builds the framework and reports to the board for part of the week.
How do I hire a chief risk officer?
Set the remit against finance, compliance and audit, decide whether it is a regulated function, secure access to the board, and test candidates on risks they raised.
We send a shortlist of 3–5, each with pay or day rate, availability and IR35 position set out.
