A chief risk officer (CRO), chief risk management officer (CRMO), or chief risk and compliance officer (CRCO), is an executive accountable for enabling the efficient and effective governance of significant risks, and related opportunities, to a business and its various segments. Risks are commonly categorized as strategic, reputational, operational, financial, or compliance-related. CROs are accountable to the Executive Committee and The Board for enabling the business to balance risk and reward. In more complex organizations, they are generally responsible for coordinating the organization's Enterprise Risk Management (ERM) approach. The CRO is responsible for assessing and mitigating significant competitive, regulatory, and technological threats to a firm's capital and earnings. The CRO roles and responsibilities vary depending on the size of the organization and industry. The CRO works to ensure that the firm is compliant with government regulations, such as Sarbanes–Oxley, and reviews factors that could negatively affect investments. Typically, the CRO is responsible for the firm's risk management operations, including managing, identifying, evaluating, reporting and overseeing the firm's risks externally and internally to the organization and works diligently with senior management such as chief executive officer and chief financial officer.
The role of the chief risk officer (CRO) is becoming increasingly important in financial, investment, and insurance sectors. According to Watson, the majority of CROs agreed that having only exceptional analytical skills is not sufficient. The most successful CROs are able to combine these skills with highly developed commercial, strategic, leadership and communication skill to be able to drive change and make a difference in an organization. CROs typically have post-graduate education with over 20 years of experience in accounting, economics, legal or actuarial backgrounds. A business may find a risk acceptable; however, the company as a whole may not. CROs need to balance risks with financial, investment, insurance, personnel and inventory decisions to obtain an optimum level for stakeholders. According to a study by Morgan McKinley, a successful CRO must be able to deal with complexity and ambiguity, and understand the bigger picture.
James Lam, a noted risk professional, is credited as the first person to coin the term. Lam is the first person to hold that position at GE Capital in 1993. The position became more common after the Dodd–Frank Act and the 2008 financial crisis.
A main priority for the CRO is to ensure that the organization is in full compliance with applicable regulations and to analyze all risk related issues. They may also be required to work alongside other senior executives such as with a chief compliance officer. They may deal with topics regarding insurance, internal auditing, corporate investigations, fraud, and information security. The responsibilities and requirements to become a chief risk officer vary depending on the size of the organization and the industry, however, most CROs typically have a masters-degree level of education and 10 to 20 years of business-related experience, with actuarial, accounting, economics, and legal backgrounds common. There are many different pathways to becoming a CRO but most organizations prefer to promote their own employees to the position internally.
Roles of a CRO A chief risk officer (CRO) is considered a relatively newer position in the board of directors. When comparing the function of a CRO to the rest of the officers, we find that there is a relationship with every other role. In other words, for a process in any department in a firm to be completed it has to be discussed with a CRO to clear it of potential risks. In general, the CRO has many crucial tasks to look for in any organization to better serve its needs and mitigate its risk. According to the Enterprise Risk Management Initiative, CROs need to find a way to balance risks and inventory decisions to obtain an optimum level for stakeholders and maintain a positive reputation regarding the firm. However, the job description of CRO there is more in depth, there are some general tasks which every CRO has to be familiar with, such as, understanding the concept of Enterprise Risk Management (ERM).
A chief risk officer must identify, assess, measure, manage, monitor and report every aspect of the risk function of new implementations of the firm. This task is important when translating the business requirements of the firm into business/reporting and system specifications. Also, the CRO's assistance is necessary when it comes to new developments. Risk Chiefs must be leaders in developing and improving management reporting as well as providing user training for in-house developed systems. In addition to developing policies and frameworks, the CRO is responsible for the training and supervision of employees. Another important task is managing the development of new risk policies and procedures and participating in local and global discussions to enhance security processes and standards.Managing Risks: A New Framework, Retrieved 2 December 2017
The role of the CRO is still evolving as the scope of task is constantly changing. The increasing regulatory and legislative requirements of organizational compliance make the CRO an important member of the management team. The success of structural planning relies on viewing risk in the context of the whole company and organizing different risk functions and tasks for the different entities of the organization.
Related positions of a CRO
The title of CRO is a fairly new position in a company that is continually evolving. The responsibility of a CRO can be supported by the CEO or CFO. However, having an independent position to mitigate risks close to the executive board is a real asset for the company. Although the title of CRO is fairly new, job titles such as CFOs and CEOs also have functions of a CRO. Related positions of a CRO include CEO, CFO, chief risk management officer, Risk Manager and Capital Manager. Although these related positions don't necessarily replace a CRO, they do hold job functions that are similar to those of a CRO.
Some names can be cited as examples of chief risk officer. This new position is found in many different industries. The major one is in the financial sector. For instance, Craig Broderick is the CRO of Goldman Sachs in the United States with nine years of experience, Joachim Oechslin works for Credit Suisse in Switzerland as CRO and Thomas Wilson ensures to mitigate risk at Allianz in Germany.
Companies in other industries have hired CROs in order to become more competitive.
Industry backgrounds In August 1993, James Lam became the first worldwide CRO at GE Capital. He is called the inventor of the ERM model. As a CRO, Lam's responsibilities were to mitigate the risks of the company. He managed the credit risks, market risk, risk transfer and hedge risk. In 1995, a few company executives started to hire CROs in their organizations. But the demand was still low in the CRO position. The Sarbanes–Oxley Act and the 2008 financial crisis increased hiring of CROs.“A View from the Top: The Growing Role of the Chief Risk Officer” by William Atkinson
Characteristics and qualifications The qualifications of a chief risk officer are dependent on the industry and the type of the business. At the same time - whether in the technology, retail, healthcare, or finance industry - the characteristics of the typical CRO will be similar, built on Staff, E. R. (2005, May 01). Role of the Chief Risk Officer. Retrieved December 02, 2017, from Job Profile: Chief Risk Officer. (n.d.). Retrieved December 02, 2017 at least ten years industry experience, usually in a position from middle management through senior executive.Lam, James. (2013). 19. In Enterprise Risk Management (pp. 342-343). Hoboken, NJ: Wiley. They will also have an analytical background - math, accounting or finance - along with extensive knowledge of their relevant industry regulations, reporting procedures and monitoring protocols.
In the banking sector, as an example, the CRO typically worked in, or ran, enterprise risk management, quantitative risk management or treasury management; given compliance requirements,Part Three: The role of the chief risk officer (CRO). (2009, July 23). Retrieved December 10, 2017 with e.g. Sarbanes–Oxley, it is not uncommon for a financial director to move into the CRO role. In other industries, backgrounds would include, also, internal audit, strategic planning and engineering management.
The CRO typically holds a postgraduate qualification such as a Masters in accounting, in finance or in economics; many (additionally) hold an MBA. Given the background outlined, registration as a professional accountant or qualified actuary is common. CROs often also hold a Masters in risk management and / or one of the risk-specific industry certifications.The Rise of the Chief Risk Officer, Institutional Investor (March 2017).
Salary Chief risk officer salaries vary widely and depend on the company and status the specific CRO achieved.
The average pay for a chief risk officer (CRO) with regulatory compliance skills in the US is about $162,274 per year. Risk Officers who work for banks earn slightly more at $180,970. Those managing risks for private corporations are paid a higher average salary of $216,000 annually.
Chief risk officers are in the bottom tenth percentile, with a salary of $72,750. However, CROs with years of effectiveness and successful developments often pass the quarter million mark annually, so there is no earnings limit.
ERM process and the CRO Enterprise risk management Enterprise Risk Management, ERM, is a fairly new process of managing risk within a company. Although ERM has yet to be widely accepted as an industry standard since there are various definitions as to what ERM exactly is, more recognition and acceptance of ERM has been shown. There are seminars dedicated to ERM explaining the process and providing examples of applications while also discussing advances in the field.Enterprise Risk Management – Integrated Framework. (n.d.). Retrieved December 01,2017 Papers on ERM are also beginning to appear in journals and books which are starting to be published. Some universities are even starting to offer courses regarding ERM and the process.
Definitions of ERM A definition provided by the committee of Sponsoring Organization of the Treadway Commission (COSO) in 2004 defines ERM as a process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be with its appetite, to provide reasonable assurance regarding the achievement of entity objectives.Enterprise Risk Management Committee of Casualty Actuarial Society. “Overview of Enterprise Risk Management.” Casualty Actuarial Society, Summer 2003, pp. 99-163.
Another definition provided by the International Organization of Standardization (ISO 3100) defines ERM as coordinated activities to direct and control an organization with regard to risk.Lam, J. (2013). Enterprise risk management: from incentives to controls. Hoboken, NJ: Wiley.
According to James Lam, the definition of ERM is a value added function can be described as the inclusive and cohesive framework for managing key risks in order to achieve business goals, mitigate unexpected earnings unpredictability, and increase firm value to reduce risk which is a variable that can cause deviation from an expected outcome.
The benefits of ERM