ERM Success Rests on the CEO & CRO

An editorial in this month's US Banker magazine discusses the role of both the Chief Executive Officer ("CEO") and the Chief Risk Officer ("CRO") in managing risk. It all starts with the CEO establishing the appropriate risk culture and setting the risk appetite for the organization. When this is fully delegated to the CRO as part of an enterprise risk management program, the CRO is doomed to failure. Here's why.

The CRO cannot be expected to do what only the CEO can do—which is to take the lead in strategic risk-taking, protecting the franchise and building a strong risk culture. But if the CEO takes on these fundamental risk management responsibilities, the CRO can be an effective and valuable contributor to the bank's success. The CRO helps the CEO and the board implement a credible, consistent risk management framework to govern the bank's risk-taking across all businesses; provides expert, unbiased advice on risk issues; and offers constructive ideas that use smarter risk management to unlock new business opportunities.

Handing off full responsibility for the bank's enterprise risk management is the wrong reason to have a CRO. The result is likely to be an expensive compliance bureaucracy that creates a false sense of security. The CRO becomes merely an actor in a diverting farce that presents the façade of risk management without the reality of risk management. As many banks discovered in the financial crisis, this farce can turn into a tragedy when the music stops.

A solid CEO/CRO partnership is crucial to the long-term success of an enterprise risk management program. Even more crucial is having a CEO who understands and is willing to accept his/her role as the true risk leader in the company.

Demand for CROs on the Rise

Chief Risk Officers are beginning to make their mark in industries other than financial services, according to a recent article by Lloyd's.  Many of these new positions will need to be filled by risk managers that may not necessarily have the full complement of skills that their financial services peers may possess.  Here is what Lloyd's and a seasoned risk management practitioner have to say about the issue.

In these times of economic uncertainty, with risk management increasingly recognised as a core competency, insiders now expect CROs to start appearing in major industry sectors outside financial services.  Some insiders have questioned whether risk managers, who traditionally have a background in operational issues, have the necessary financial skills to make the transition however. Joe Restoule, president of the US risk manager association the Risk & Insurance Management Society (RIMS), thinks not.

Restoule, who is in charge of risk management at NOVA Chemicals Corporation, thinks that those risk managers that have embraced enterprise risk management (ERM) have by necessity become more financially savvy.  “It isn’t widespread yet but I sense that risk managers are certainly aspiring to ascend to the CRO position. Risk managers have to be more financially focused because there is so much emphasis today on liquidity and solvency—in terms of their own business but also in terms of the insurers they must deal with,” he says from his office in Calgary, Canada. “So we’re getting better all the time at using the tools to manage these financial risks.”

As more companies adopt an Enterprise Risk Management approach, qualified candidates for the new CRO role will emerge.  It is only a matter of time.