The CRO and the risk function · RiskAtoms Academy

By the end you will be able to

1Describe the Chief Risk Officer's mandate, independence and reporting lines.
2List what the risk function does day to day, and what it must never do.
3Judge whether an organisation chart gives the CRO real independence.
4Explain how regimes such as the UK SM&CR make the CRO personally accountable.

Why it matters

In April 2022, as interest rates began their fastest rise in decades, Silicon Valley Bank's Chief Risk Officer stepped down. The post stayed empty for about eight months. A year later the bank was gone.

Core explanation

Senior, independent, and heard

The board sets the risk appetite (L2.3.02: The board and its risk committee). Someone inside the firm must then watch, every day, whether the business stays within it. That person is the Chief Risk Officer (CRO), who leads the risk management function.

Think of a football referee. The players (the business) want to win, and most play fairly. The referee is not on either team, is paid the same whoever wins, and can stop the game. A referee who was paid by one team, or who could be sacked at half-time by its captain, would not be much use. The CRO's independence works the same way.

What the CRO and the risk function do.

Job	In practice
Identify	Spot new and emerging risks, including in new products and markets.
Measure	Run the models and metrics: value at risk, credit exposures, stress tests, liquidity.
Monitor	Track the firm's risks against its appetite and limits, every day.
Challenge	Question the business's plans and, where needed, block them or escalate.
Report	Tell senior management and the board where the firm stands, plainly.

The CRO usually has a formal say over key decisions: sign-off in new product approval, a vote or veto on large deals, and the authority to set limits within the appetite. Risk officers who sit inside the businesses report to the CRO, not to the business heads, so their challenge is not softened by their boss's targets.

What makes the CRO independent. The Basel Committee's 2015 principles describe a CRO with “sufficient stature, independence, resources and access to the board”. In practice, five things matter:

Five tests of CRO independence

Reporting line. To the CEO (or the board), never to a business head or the CFO.
Direct access. To the board risk committee, without impediment, including private sessions.
Protected tenure. Appointment and removal approved by the board or its risk committee; the BCBS adds that a removal should be disclosed publicly.
Independent pay. Based on the risk function's own objectives, not on the revenue of the businesses it oversees.
No dual hatting. The CRO should not also be CFO, COO or a business head.

Many large banks give the CRO a dual reporting line: a management line to the CEO and a direct line to the chair of the board risk committee. The US Federal Reserve requires the CRO of a large bank holding company to report directly to both the risk committee and the CEO.

What would a good CRO do? Guess, then reveal.

Try it

The chart starts with a weak set-up that was common before 2008: the CRO reports to the CFO and doubles as finance director. Change the reporting line and the switches, and watch the independence checks. Then load the strong set-up and compare.

Try itSet the CRO's reporting lines

Management lineDirect access to the committee

The CRO reports to

Direct access to the risk committeeBoard must approve removalPay tied to trading revenueCRO is also the CFO

Independence

1 / 5

Reporting line free of business or finance targets. The CFO answers for profits and the accounts. Risk should not sit under the function whose results it checks.
Direct access to the board risk committee. The CRO must be able to reach the board without impediment, including in private sessions without executives.
Removal needs board approval. If the CEO alone can fire the CRO, every challenge to the CEO carries a career risk. BCBS also asks for removal to be disclosed publicly.
Pay independent of the businesses overseen. Pay tied to business revenue rewards the CRO for letting risk grow.
No dual hatting. A CRO who is also CFO or COO is checking their own work. BCBS says there should be no dual hatting.

Worked example

The CRO and the big deal

A Singapore-based bank's corporate bank wants to lend US$800 million to a single shipping group, which would make it the bank's largest exposure to one borrower. Follow the CRO.

One deal through the risk function

Step 1 of 5

1
The request
The relationship team brings the deal to the credit committee. The client is a long-standing one and the fees are attractive.

Regulatory lens

Global: BCBS Corporate governance principles for banks (2015), principle 6: an independent risk function under a CRO with stature, resources and board access; no dual hatting; board approval and public disclosure for removal.
EU: the Capital Requirements Directive (Article 76) makes the head of risk an independent senior manager who cannot be removed without the approval of the supervisory board and who can report to it directly.
UK: under the Senior Managers and Certification Regime (banks from 2016), the Chief Risk function is a Senior Manager Function. The CRO has a Statement of Responsibilities and a duty of responsibility: if a breach happens in their area and they did not take reasonable steps, they can be held personally to account.
US: Regulation YY (2014) requires a CRO at large bank holding companies who reports directly to the risk committee and the CEO, with pay structured to keep them independent.
Asia-Pacific and elsewhere: similar personal accountability regimes include Australia's Financial Accountability Regime (banks from March 2024), Hong Kong's Manager-in-Charge regime (SFC, 2017), Singapore's Guidelines on Individual Accountability and Conduct (MAS, from September 2021) and Ireland's Senior Executive Accountability Regime (from July 2024).

Sparks

SparkA young job title

The CRO is a recent invention. James Lam, at GE Capital in 1993, is often credited as the first person to hold the title. Before the 2000s, risk was usually a department inside finance or treasury.

SparkWhy disclose a firing?

Most executives can be replaced without a public word. The BCBS asks banks to disclose a CRO's removal and discuss the reasons with their supervisor, because an unexplained exit can be the first sign that someone did not want to hear about risk.

Key takeaways

The CRO leads an independent risk function that identifies, measures, monitors, challenges and reports risk.
Independence rests on five things: reporting line, direct board access, protected tenure, independent pay and no dual hatting.
A CRO should report to the CEO with a direct line to the board risk committee, never to a business head or the CFO.
Risk officers inside the businesses report to the CRO, so their challenge is not softened by business targets.
Accountability regimes (UK SM&CR, Australia's FAR, Hong Kong's MIC, Singapore's IAC) make named senior managers, including the CRO, personally answerable.

Reaction

Check what stuck

Glossary

Chief Risk Officer (CRO): Chief Risk Officer: the senior executive who leads the firm's independent risk management function.
Risk management function: The team, independent of the businesses that take risk, that identifies, measures, monitors, challenges and reports the firm's risks.
Reporting line: The line of authority that says who a person answers to, who sets their objectives and who reviews them.
Dual hatting: One person holding two roles whose duties conflict, such as a CRO who is also the CFO.
Veto: The right to block a decision, such as a new product or a large deal, until a risk concern is resolved.
New product approval: New product approval: the process every new product, market or business must pass, with sign-off from risk and other control functions.

Deep Dives & Origins

Deep Dives

Lam, J., Enterprise Risk Management: From Incentives to Controls, 2nd edition, Wiley, 2014. Intermediate.
Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015, principle 6. Intermediate.

Origins

Basel Committee on Banking Supervision, Corporate governance principles for banks, BIS, July 2015, paragraphs 105 to 111.
Directive 2013/36/EU (Capital Requirements Directive), Article 76(5).
Bank of England Prudential Regulation Authority and Financial Conduct Authority, Senior Managers and Certification Regime rules and guidance.
Board of Governors of the Federal Reserve System, Regulation YY, Enhanced Prudential Standards, 12 CFR part 252.
Board of Governors of the Federal Reserve System, Review of the Federal Reserve's Supervision and Regulation of Silicon Valley Bank, April 2023.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.