Chief Risk Officer succession

The post-pandemic Chief Risk Officer (CRO) requires a set of skills that the Risk function is struggling to produce.

As we emerge from two years of pandemic-induced change to almost every aspect of our lives – some temporary, some perhaps more permanent – one thing becoming clear is that the role of the CRO is evolving at a pace and scale that is outstripping the Risk function’s ability to develop successors for it.

As we witnessed with Chief Compliance Officers in the post-financial crisis decade, Risk professionals are increasingly failing to land the largest and most complex CRO roles as financial institutions seek to rapidly adapt in a post-pandemic, technology-enabled and ESG focused world.

CRO appointments have more than doubled over the last two years.

The scarcity of credible candidates for the biggest CRO roles is not a new issue, but is now brought sharply into focus by the heightened demand for them. The majority of these changes have been driven by the need for a different skillset in the CRO, rather than through leaving or retiring of their own accord.

However, over half of these have been filled internally (often after an extensive external search) by appointing leaders from other functions or even the business. Since 2020, 60% of major bank Group CRO appointments and 43% of FTSE 100 appointments have been leaders without any significant prior Risk experience.

Why is the Risk community not producing credible candidates for the most senior positions?

Back in 2015, in our report The Teenage Years: The Post Financial Crisis Chief Risk Officer we highlighted the lack of succession potential from within the Risk function and the need for urgent action to address this. Seven years on, and with the succession challenge not having been addressed, the issue is becoming acute. With the scope and impact of emerging risks continuing to grow, along with unprecedented pressure on financial services organisations to play a more active role in delivering wider societal objectives (see our 2020 report Who is Managing Your Trust Risk), the challenge is more critical than ever.

The three key skills…

1. A breadth of perspective beyond traditional Risk disciplines

With non-financial risk rising rapidly up the agenda and new emerging risks such as cyber and climate, the CRO is operating in an uncertain world with a much more complex external stakeholder environment. Increasingly, the breadth and insights required in the CRO would appear to be more readily gained through spending time in other parts of the organisation, rather than coming up the Risk vertical.

2. Deep understanding of the organisation – strategically, commercially and culturally

With purpose and values playing an ever more prominent role in decision making, Risk management is as much a cultural and organisational challenge as a technical one. It is therefore critical that the CRO has a close grip on the pulse of the organisation and an intuitive understanding of the culture and the risks inherent in it. Being able to align strategic and commercial imperatives with the expectations of a much wider spectrum of external stakeholders, is now a key element of successful Risk management and requires a comprehensive understanding of all these constituent parts. Only a leader who understands the organisation through these perspectives is truly able to shape the Risk management agenda and, in turn, be a reassuring presence around the top table.

3. Extremely high level of trust and credibility with the Board and CEO

Boards have spent the last two years navigating uncharted waters and continue to do so. The decisions have come thick and fast; many are new and extremely complex, Ukraine being the latest example of this. There is often no immediate right answer. In this constantly uncertain environment, trust in the CRO’s judgement is more important than ever. It requires an individual who is comfortable operating at the most senior levels and has demonstrated the ability to think holistically through problems and synthesise their thinking for a senior audience.

But is appointing from outside of the function sustainable?

No. This is an expedient solution – it is notable that in many cases the decision to appoint an internal candidate has been made only after an extensive external search and, in any event, there will not always be a viable internal option.

Importantly, it does not address the issue that Risk functions are failing to produce enough senior leaders, and, if the scope and complexity of the remit continues to grow, the Risk function’s requirement to develop senior leaders will become even more urgent.

So how can Risk functions address this? Search for ‘learning agility’.

The key to cracking this is learning agility, often summarised as ‘knowing what to do when you don’t know what to do’. Identifying emerging Risk leaders with high learning agility, and developing a culture that embraces this to enable them to maximise their potential, will begin to unlock talent.

The cultural change for the Risk function, alongside this, entails finding the balance between creating enterprise wide leaders and subject matter experts – in a highly technical function it is about the emphasis placed on leadership skills versus technical skills.

At Hedley May, as we help our clients navigate this complex world, we have concluded that identifying learning agility as part of our assessment of a candidate’s potential has not just become important – it has become paramount. If Risk functions come to the same conclusion then there is every reason to believe that the next CRO will come from within the function.