The three key skills…
1. A breadth of perspective beyond traditional Risk disciplines
With non-financial risk rising rapidly up the agenda and new emerging risks such as cyber and climate, the CRO is operating in an uncertain world with a much more complex external stakeholder environment. Increasingly, the breadth and insights required in the CRO would appear to be more readily gained through spending time in other parts of the organisation, rather than coming up the Risk vertical.
2. Deep understanding of the organisation – strategically, commercially and culturally
With purpose and values playing an ever more prominent role in decision making, Risk management is as much a cultural and organisational challenge as a technical one. It is therefore critical that the CRO has a close grip on the pulse of the organisation and an intuitive understanding of the culture and the risks inherent in it. Being able to align strategic and commercial imperatives with the expectations of a much wider spectrum of external stakeholders, is now a key element of successful Risk management and requires a comprehensive understanding of all these constituent parts. Only a leader who understands the organisation through these perspectives is truly able to shape the Risk management agenda and, in turn, be a reassuring presence around the top table.
3. Extremely high level of trust and credibility with the Board and CEO
Boards have spent the last two years navigating uncharted waters and continue to do so. The decisions have come thick and fast; many are new and extremely complex, Ukraine being the latest example of this. There is often no immediate right answer. In this constantly uncertain environment, trust in the CRO’s judgement is more important than ever. It requires an individual who is comfortable operating at the most senior levels and has demonstrated the ability to think holistically through problems and synthesise their thinking for a senior audience.
But is appointing from outside of the function sustainable?
No. This is an expedient solution – it is notable that in many cases the decision to appoint an internal candidate has been made only after an extensive external search and, in any event, there will not always be a viable internal option.
Importantly, it does not address the issue that Risk functions are failing to produce enough senior leaders, and, if the scope and complexity of the remit continues to grow, the Risk function’s requirement to develop senior leaders will become even more urgent.