Chief risk officer
CROAlso called head of risk, head of the risk management function
A chief risk officer is the senior executive who leads a firm's independent risk management function. The CRO oversees how risks are identified, measured and reported, challenges business decisions against the board's risk appetite and gives the board an independent view of the firm's overall risk profile.
How it works
The CRO sits in the second line of defence, separate from the business units that take risk. The role covers credit, market, liquidity, operational and model risk, sets limits within the board's risk appetite and reports breaches. The CRO usually reports to the chief executive and has direct access to the board risk committee.
EU rules require banks to have an independent head of risk who cannot be removed without prior approval of the management body. In the UK, the chief risk function is a senior manager function, so the holder is personally accountable for it. Supervisors meet CROs regularly and treat the role as a check on excessive risk taking.
The rules
Requires an independent risk management function headed by an independent senior manager who cannot be removed without prior approval of the management body.
Credit institutions and investment firms in the EUMakes the chief risk function a senior manager function requiring regulatory approval and a statement of responsibilities.
UK banks, building societies and PRA-designated investment firmsSets expectations for the head of the risk management function, including independence, access to the board and authority to challenge decisions.
Institutions subject to the Capital Requirements DirectiveCommon questions
Who does the chief risk officer report to?
Usually the chief executive, with direct access to the board risk committee. EU guidelines expect the head of risk to be able to raise concerns with the board directly, without going through business management.
Is a chief risk officer required by law?
EU rules require banks to have an independent head of the risk management function, and in the UK the chief risk function is a senior manager function needing regulatory approval. Smaller firms apply the rules proportionately.
How is a CRO different from a chief compliance officer?
The CRO oversees financial and non-financial risks across the firm, such as credit, market and operational risk. The chief compliance officer focuses on compliance with laws and rules. Some firms combine the roles.
