CRO · Chief Risk Officer

The chief risk officer exists to give risk a senior, independent voice at the executive table. Individual managers see their own risks; someone must see how exposures aggregate, where they concentrate and whether the total stays within what the board will tolerate. Without a CRO, that aggregate view either does not exist or arrives filtered through the interests of the units reporting it. For the board, the CRO is the executive who can say uncomfortable things about the portfolio of risks with data behind them.

The role is chartered in the risk management framework: the CRO builds the methodology, proposes risk appetite to the board, runs aggregate reporting and challenges business decisions from the second line. The CRO typically reports to the CEO with a direct line to the board's risk committee, which protects independence. Example: the CRO's analysis shows that three business units unknowingly depend on the same single supplier, and the resulting concentration breaches proposed appetite, forcing an executive decision on dual sourcing. In many groups the CRO also carries operational resilience, linking risk appetite to impact tolerances.

The recurring confusion is treating the CRO as the owner of all risks, which quietly relieves line management of accountability. The CRO owns the framework and the challenge; the risks stay with the managers who run the business. A CRO measured by the absence of incidents will also be tempted to filter bad news, so reporting lines and metrics matter. The design of the risk function is examined in ERGP module M2, on risk.