Chief risk officer

Overview

A chief risk officer (CRO), chief risk management officer (CRMO), or chief risk and compliance officer (CRCO), is an executive accountable for enabling the efficient and effective governance of significant risks, and related opportunities, to a business and its various segments. Risks are commonly categorized as strategic, reputational, operational, financial, or compliance-related. CROs are accountable to the Executive Committee and The Board for enabling the business to balance risk and reward. In more complex organizations, they are generally responsible for coordinating the organization's Enterprise Risk Management (ERM) approach. The CRO is responsible for assessing and mitigating significant competitive, regulatory, and technological threats to a firm's capital and earnings. The CRO roles and responsibilities vary depending on the size of the organization and industry. The CRO works to ensure that the firm is compliant with government regulations, such as Sarbanes–Oxley, and reviews factors that could negatively affect investments. Typically, the CRO is responsible for the firm's risk management operations, including managing, identifying, evaluating, reporting and overseeing the firm's risks externally and internally to the organization and works diligently with senior management such as chief executive officer and chief financial officer. The role of the chief risk officer (CRO) is becoming increasingly important in financial, investment, and insurance sectors. According to Watson, the majority of CROs agreed that having only exceptional analytical skills is not sufficient. The most successful CROs are able to combine these skills with highly developed commercial, strategic, leadership and communication skill to be able to drive change and make a difference in an organization. CROs typically have post-graduate education with over 20 years of experience in accounting, economics, legal or actuarial backgrounds. A business may find a risk acceptable; however, the company as a whole may not. CROs need to balance risks with financial, investment, insurance, personnel and inventory decisions to obtain an optimum level for stakeholders. According to a study by Morgan McKinley, a successful CRO must be able to deal with complexity and ambiguity, and understand the bigger picture. James Lam, a noted risk professional, is credited as the first person to coin the term. Lam is the first person to hold that position at GE Capital in 1993. The position became more common after the Dodd–Frank Act and the 2008 financial crisis. A main priority for the CRO is to ensure that the organization is in full compliance with applicable regulations and to analyze all risk related issues. They may also be required to work alongside other senior executives such as with a chief compliance officer. They may deal with topics regarding insurance, internal auditing, corporate investigations, fraud, and information security. The responsibilities and requirements to become a chief risk officer vary depending on the size of the organization and the industry, however, most CROs typically have a masters-degree level of education and 10 to 20 years of business-related experience, with actuarial, accounting, economics, and legal backgrounds common. There are many different pathways to becoming a CRO but most organizations prefer to promote their own employees to the position internally.

Roles of a CRO

A chief risk officer (CRO) is considered a relatively newer position in the board of directors. When comparing the function of a CRO to the rest of the officers, we find that there is a relationship with every other role. In other words, for a process in any department in a firm to be completed it has to be discussed with a CRO to clear it of potential risks. In general, the CRO has many crucial tasks to look for in any organization to better serve its needs and mitigate its risk. According to the Enterprise Risk Management Initiative, CROs need to find a way to balance risks and inventory decisions to obtain an optimum level for stakeholders and maintain a positive reputation regarding the firm. However, the job description of CRO there is more in depth, there are some general tasks which every CRO has to be familiar with, such as, understanding the concept of Enterprise Risk Management (ERM). A chief risk officer must identify, assess, measure, manage, monitor and report every aspect of the risk function of new implementations of the firm. This task is important when translating the business requirements of the firm into business/reporting and system specifications. Also, the CRO's assistance is necessary when it comes to new developments. Risk Chiefs must be leaders in developing and improving management reporting as well as providing user training for in-house developed systems. In addition to developing policies and frameworks, the CRO is responsible for the training and supervision of employees. Another important task is managing the development of new risk policies and procedures and participating in local and global discussions to enhance security processes and standards. The role of the CRO is still evolving as the scope of task is constantly changing. The increasing regulatory and legislative requirements of organizational compliance make the CRO an important member of the management team. The success of structural planning relies on viewing risk in the context of the whole company and organizing different risk functions and tasks for the different entities of the organization.

Related positions of a CRO

The title of CRO is a fairly new position in a company that is continually evolving. The responsibility of a CRO can be supported by the CEO or CFO. However, having an independent position to mitigate risks close to the executive board is a real asset for the company. Although the title of CRO is fairly new, job titles such as CFOs and CEOs also have functions of a CRO. Related positions of a CRO include CEO, CFO, chief risk management officer, Risk Manager and Capital Manager. Although these related positions don't necessarily replace a CRO, they do hold job functions that are similar to those of a CRO. Some names can be cited as examples of chief risk officer. This new position is found in many different industries. The major one is in the financial sector. For instance, Craig Broderick is the CRO of Goldman Sachs in the United States with nine years of experience, Joachim Oechslin works for Credit Suisse in Switzerland as CRO and Thomas Wilson ensures to mitigate risk at Allianz in Germany. Companies in other industries have hired CROs in order to become more competitive.

Industry backgrounds

In August 1993, James Lam became the first worldwide CRO at GE Capital. He is called the inventor of the ERM model. As a CRO, Lam's responsibilities were to mitigate the risks of the company. He managed the credit risks, market risk, risk transfer and hedge risk. In 1995, a few company executives started to hire CROs in their organizations. But the demand was still low in the CRO position. The Sarbanes–Oxley Act and the 2008 financial crisis increased hiring of CROs.

Characteristics and qualifications

The qualifications of a chief risk officer are dependent on the industry and the type of the business. At the same time - whether in the technology, retail, healthcare, or finance industry - the characteristics of the typical CRO will be similar, built on

at least ten years industry experience, usually in a position from middle management through senior executive. They will also have an analytical background - math, accounting or finance - along with extensive knowledge of their relevant industry regulations, reporting procedures and monitoring protocols. In the banking sector, as an example, the CRO typically worked in, or ran, enterprise risk management, quantitative risk management or treasury management; given compliance requirements, with e.g. Sarbanes–Oxley, it is not uncommon for a financial director to move into the CRO role. In other industries, backgrounds would include, also, internal audit, strategic planning and engineering management. The CRO typically holds a postgraduate qualification such as a Masters in accounting, in finance or in economics; many (additionally) hold an MBA. Given the background outlined, registration as a professional accountant or qualified actuary is common. CROs often also hold a Masters in risk management and / or one of the risk-specific industry certifications.

Salary

Chief risk officer salaries vary widely and depend on the company and status the specific CRO achieved. The average pay for a chief risk officer (CRO) with regulatory compliance skills in the US is about $162,274 per year. Risk Officers who work for banks earn slightly more at $180,970. Those managing risks for private corporations are paid a higher average salary of $216,000 annually. Chief risk officers are in the bottom tenth percentile, with a salary of $72,750. However, CROs with years of effectiveness and successful developments often pass the quarter million mark annually, so there is no earnings limit.

Enterprise risk management

Enterprise Risk Management, ERM, is a fairly new process of managing risk within a company. Although ERM has yet to be widely accepted as an industry standard since there are various definitions as to what ERM exactly is, more recognition and acceptance of ERM has been shown. There are seminars dedicated to ERM explaining the process and providing examples of applications while also discussing advances in the field. Papers on ERM are also beginning to appear in journals and books which are starting to be published. Some universities are even starting to offer courses regarding ERM and the process.

Definitions of ERM

A definition provided by the committee of Sponsoring Organization of the Treadway Commission (COSO) in 2004 defines ERM as a process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be with its appetite, to provide reasonable assurance regarding the achievement of entity objectives. Another definition provided by the International Organization of Standardization (ISO 3100) defines ERM as coordinated activities to direct and control an organization with regard to risk. According to James Lam, the definition of ERM is a value added function can be described as the inclusive and cohesive framework for managing key risks in order to achieve business goals, mitigate unexpected earnings unpredictability, and increase firm value to reduce risk which is a variable that can cause deviation from an expected outcome.

The benefits of ERM

According to James Lam, author of the book “Enterprise Risk Management,” there are several primary benefits of using ERM: 1) enhanced organizational effectiveness, 2) increased efficiency in terms of risk reporting, 3) improved business performance. Organizational effectiveness helps address special and specific risks by creating the top-down coordination needed to form an integrated team suited to handle both independent risks and interdependencies between risks. Moreover, ERM has been said to increased risk management awareness allowing for more efficient operational and strategic decision making. This is done through the appointment of a chief risk officer and the establishment of an enterprise risk function. Risk reporting assists both the chief risk officer of an organization and the board of governors in identifying key risk factors that may prove detrimental to the company in both the present and the future. Thus, ERM enables senior management to identify, measure, and limit to acceptable levels the net exposures faced by the firm. Being able to create risk transparency allows a firm to better hedge against those particular risks or avoid them all together. Better business performance is yet another benefit of using ERM. Companies that adopt an ERM approach have seen improvements in areas requiring key management decisions from capitol allocations to product development and pricing to mergers and acquisitions. As a result, this leads to the benefits and improvements gained from utilizing an ERM approach can be seen in the form of loss reduction, improved shareholder value, decreased earning volatility, and an increase in the firms’ earnings.

The chief risk officer

The ERM model implies the leadership by an individual who is responsible for the development and implication of an ERM strategy and assists the senior management in terms of risk management. In order to do this a CRO sets up a risk management framework and policies based on the ERM strategy. Furthermore, the CRO implements reports and risk indicators to communicate the risk culture throughout the firm. These reports assist the CRO in creating a risk profile. The CRO communicates the firm's risk profile to the key stakeholders such as the CEO, the board of directors, and business partners. Optimizing the risk portfolio is another assigned task by the ERM. The CRO advises firm projects from a risk management point of view and uses regulations and risk transfer strategies in order to mitigate the risk.

ERM vs silo

ERM: An ERM requires an integrated risk organization, which normally means that a centralized risk management unit has to report to the CEO and the board of directors. The chief risk officer in an ERM is responsible for knowing and gathering information over all the different aspects within an organization. He takes a portfolio view of all types of risks within the company. In an ERM approach, the use of insurance and alternative risk transfer products is only considered if the risk seemed undesirable or unwanted to the management. Integration of risk management in the whole company's business process becomes necessary. The ERM optimizes business performance by influencing different aspects like pricing and resource allocation. There are three major benefits connected to the use of the ERM approach and the CRO as liaison: Due to the fact that a CRO and an integrated team can better manage individual risks and interdependencies between these risks, the use of an ERM leads to increased organizational effectiveness. Apart from this fact, better risk reporting can be reached by prioritizing the content of risk reporting that should go to the different instances like the senior management or the board of directors. A side effect of this information prioritizing is much better transparency throughout the whole organization. Last but not least you can also reach a better overall business performance in the company. This is only possible if the risk management team uses an ERM approach and supports key management decisions like pricing, product development or Mergers and acquisitions. Given the support, there will be several benefits like increased earnings and improved shareholder value. An ERM can combine and integrate several risk silos into a firm-wide risk portfolio and can consider aspects such as volatility and correlation of all risk exposures. This can lead to a maximization of the diversification's benefits. Silo: Under a silo approach, risk transfer strategies are executed under a transactional or individual risk level. As an example insurance can be mentioned, which transfers out operational risk. Risk assessment and quantification processes are not integrated. Value-at-risk models are used to quantify the market risk and credit default models are used to estimate credit risk. Both specific models could be used independently, but still: that is not the case in the Silo approach. There are different effects that can be caused by this less integrative model: Over-hedging and far too much insurance coverage can be a result of not incorporating all the different kinds of risk and their wide diversification. Another characteristic of the Silo approach is the continuous fighting of one crisis after another without having an integrative concept or a specific individual that can be held responsible. No one specifically takes responsibility for aspects like the overall risk reporting or other risk-related unit supplies. Further more there is another aspect that shows a weakness of this model: Having different organizational units to address every specific risk that the first has to be segmented in the company definitely speaks for a less effective technique. In the Silo approach, the different business units use various methodologies to track counterparty risks. This can become a problem, if you look at the total counterparty exposure: it can get too great to be managed by all the different business units.

Risk champion

After a near miss or an actual crisis managers are often alarmed and focus more on all aspects of risk during the ongoing inspection. They are looking at aspects like the compliance risk and they are reinforcing important roles for the board. All these actions often lead to the naming of a risk champion who is then responsible for developing and establishing an ERM approach. In many companies, the risk champion is becoming more and more a formal senior management position: the CRO. One of the important function of a risk champion that should be mentioned is his/her support to legitimize the implementation of risk management itself. Apart from this fact he also helps the institution follow its objectives and better site it for the future. Further more he is also responsible for communicating its benefits. Normally a risk champion should have the different characteristics like skills, knowledge, and leadership qualities, necessary to handle all the different specific aspects that can occur in the process of risk management. Other aspects that should be mentioned considering the responsibilities of a risk champion is his duty to intervene in instances where risk management efforts are actually disabled. This can be caused by the management itself or a lack of institutional skills. Additionally he also provides support to the whole risk management process if a problematic, complicated risk occurs. In this case, he can use the multiple-participant approach. Assisting the risk owner, but not assuming his or her role to help find a solution for his/her problem is also one of the many duties a risk champion has to face. In some studies the risk champion is described as some kind of troubleshooter who alleviates risk-related problems. After all you can summarize that the risk champion has to be integrated into the company's ERM approach and by this contribute to the institution's goals and objectives.