Promoting a CRO From Within

Once a decision has been made to establish a fulltime Chief Risk Officer (CRO) the next logical question is whether a suitable candidate exists internally or whether one should be hired externally.  There are some definite pros and cons to both strategies, as is the case with any C-level position. An internal candidate already has institutional knowledge of the company and its structure, culture, philosophy, strategy, etc. He will already have relationships established with staff and management and hopefully the respect of his peers. However, he may not have sufficient training and experience to serve as the CRO, and sometimes being too close to part of the organization can be a liability.  Alternatively, an external candidate may bring with them related experience from prior companies and in leveraging that experience will probably be able to move much faster in building and applying an enterprise risk management framework and program.  However, it will still take time to build collaborative relationship since he starts in the position with very little political currency.

For this article we’re going to look specifically at several scenarios where an internal candidate is promoted into the CRO position, including some of the issues that tend to arise.  We are assuming that the candidate does not have prior experience as a CRO and is instead shifting from somewhere else on the organization chart. The positions we will consider include:

• Internal Audit
• Credit Administration or Chief Credit Officer
• Risk Manager

Professionals in each of these areas have unique and valuable expertise and perspective, but they also tend to overlook certain aspects of the CRO role. Hopefully the information presented here will help individuals to understand their role more fully and consider ways to further develop their skill sets.

Internal Audit

Assets: Solid understanding of the criticality of sound internal controls, comfortable with a risk assessment process, typically have a good understanding of the company structure and its culture.

Liabilities: Tendency to over-focus on internal controls (creating Internal Audit II) rather than the broader spectrum of risk. Trouble migrating from an “independent validation” role to a more collaborative role. May have difficultly establishing trust with some staff and managers.

One of most common areas that I see for harvesting new risk officers is from Internal Audit (IA). The thought processes are similar in that both areas are focused on risk to the organization and how best to mitigate that risk. But the challenge for ex-auditors is whether they can make the transition from a focus on the testing and validation of internal controls to a broader focus on risk profiles and risk alignment. The CRO needs to be the architect of the risk framework and then guide the organization in adopting and actively utilizing that framework. Practically speaking, the process is usually more persuasive than authoritative, and this is often a difficult adjustment for ex-auditors.

Suggestions: One of the best things that an ex-auditor in a CRO role can do is to study heavily the ideas of risk profiles and risk alignment.  Carefully examine not just the list of internal controls, but explore the inherent risks that drove the creation of those controls. Understand the residual risk that still exists despite those controls and how those relate to the corporate tolerance for risk. Remember, the presence of a risk does not mean the lack of a control, it means the acceptance of a risk. As a CRO they can work much more closely with business areas in helping them understand their risk profiles, but still need to ensure that the risk is owned by the business unit. Finally, they should never, ever be in the business of testing controls. They may want to, but that is IA’s job. Let them do it.

Credit Administration or Chief Credit Officer

Assets: A firm understanding of the need for sound governance. Policies, procedures, controls, analytics, accountability, etc. They are used to talking about big, scary risks and, when necessary, reigning them in.

Liabilities: To put it bluntly, they often have trouble seeing beyond credit risk. To use the old saying “When you’re a hammer everything starts to look like a nail” is very applicable in this case.

In organizations like financial institutions, such a large percentage of risk centers around credit that often the CCO is given the dual role of CCO & CRO. This is a very bad idea. No one can serve two masters, and when push comes to shove the CCO is going to focus on credit policy and credit risk. The CRO needs to be focusing on all areas of risk at all times: Credit, market, liquidity, operational, strategic, reputation, etc.  And for a CRO that has moved from the CCO position, she will need to learn that while credit risk is very important, there are many other ways to knock a hole in a ship.

Suggestions: Probably the best place to start for the CCO come CRO is to pick up any one of a number of very good books on Enterprise Risk Management and study it cover to cover. (See the “Additional Resources” section below.)  This certainly isn’t a case of forgetting what the CCO knows, it’s building on that knowledge. Also, like the ex-Internal Auditor, the new CRO will need to get used to the idea of working much more collaboratively with staff and managers. They are no longer just enforcing credit policy. They are now tasked with helping the organization discover the millions of ways that things can go wrong, how to assess those risks and how to build suitable mitigating controls. The world of credit risk is fairly defined and is entirely permission based. Other risk areas (particularly operational risk) are much less so, so risk management becomes much more subjective.

Risk Managers

Assets: For someone already functioning in a risk manager role, they probably already have good interactions with staff and management and understand the existing risk management framework and methodology.

Liabilities: They often have trouble transitioning from completing risk assessments and/or risk reports to becoming the overall program architect. They may also need to develop their executive skills since they will now be interfacing directly with the Board and the senior team.

Someone that is already participating in the risk management process, perhaps as an embedded risk manager within a part of the organization, is a definite candidate for promoting into the CRO position. They are already familiar with the forms, processes, methods, etc. of the risk framework and they should have a firm understanding of the goals of the program. However, as with all employees who are promoted into their boss’s position, they suddenly need to learn how to wear much more expensive shoes.

Suggestions: If an existing risk manager is a potential candidate for the CRO spot at some point, he should be groomed for this position. This means participating in the strategy meetings around the design of the risk framework. Being responsible for part of the combining of individual risk reports into aggregate reports for the company so that he sees “the big picture.”  Periodically sitting in on Board presentations to see how they want material presented, how discussions take place and how decisions are made. Once he is promoted into the position, the company needs to make sure that someone is tasked with his old responsibilities as quickly as possible. Unfortunately, many times an individual is very suited at the manager level but doesn’t necessarily possess the executive level skills to be able to move into the C-level position. This needs to be very carefully evaluated before making the move.

Finally, regardless of which internal candidate is promoted, the CRO should involve themselves in industry risk associations and forums. In my experience, risk managers are more than willing to learn from each other and sometimes the best way to learn is to be connected with other practitioners. Some of these associations are listed below.

The ERM Advantage

For organizations that promote a CRO from within, understanding the unique functional and cultural differences will help in smoothing the transition and ensure that the candidate is successful in their new role. Acting as the CRO is difficult enough, bringing the wrong thought process can complicate things and possibly sabotage the CRO’s attempts to direct the enterprise risk management program.

For assistance in evaluating potential internal candidates for a CRO position, or to provide training and support to an existing one, contact Eric Holmquist at Accume Partners at (856) 793-1581 or eholmquist@accumepartners.com. Visit accumepartners.com

Additional Resources

Enterprise Risk Management by James Lam

Enterprise Risk Management – Robert W. Kolb Series

The Risk Management Association

The Professional Risk Managers’ International Association (PRMIA)

The Global Association of Risk Professionals (GARP)

Various risk management forums in LinkedIn