The evolution of the Chief Risk Officer a future CEO?

Transcription

1 The evolution of the Chief Risk Officer a future CEO? It is now common for the Board and Executive to choose between two distinct camps when recruiting a new Chief Risk Officer (CRO). In light of the FCA (Financial Conduct Authority) sharpening their teeth and the new conduct regime, organisations are increasingly caught between nonfinancial and financial risk skill sets and backgrounds. Taking the evolutionary chain one step further, a third camp is emerging, calling upon broader business insight over conventional risk management experience. Therefore: Could we see CROs in the future become CEOs? Over breakfast, on the same day as the general election in May, we were delighted to be joined by an impressive set of CROs and senior figures across banking, insurance and the Bank of England to debate the evolving role of the CRO. Also present were representatives from HR and Resourcing. Not surprisingly, our discussion stimulated a number of themes, including; how CROs manage boards to maximise regulatory initiatives such as the ORSA (Own Risk and Solvency Assessment) in insurance, the challenge of developing up and coming risk talent to broaden out from a narrow Head of role in Credit Risk for example, to become ready and able to take on a CRO position effectively and the prominence of the CRO in different countries compared to the UK. We asked our speaker, an NED in banking and insurance, to provide his view on the discussion topic. He started by explaining the strong sectorial focus of the CRO in financial services, where organisations have seen a big drive and push to create better risk management in a typically more complex environment than other sectors. One of his previous roles with a US based insurance firm was at Director level, on the surface a very senior role within the firm, however, he later learned that Director in the US context is actually pretty low on the corporate totem pole. In relation to the CRO and the word Chief, what does this mean now, as the Head of a risk function within an organisation, compared to 20 years ago? Since The Walker Report was published there was no going back; risk had gone up a notch, both in banking and other financial services sectors In the early days, financial risk was such an elite area with quantitative people running VAR models, it was very difficult to understand unless you were in that group. Then we started to see the appearance of non-financial risk and the early days of the process merchants, who ran risk workshops to get other people to tell you the risks, adding value by facilitation and benchmarking. A large number of people were jumping on the band wagon to lay claim to the non-financial risk area, internal audit for instance, making it hard to pin down who actually owned risk management. Page 1 of 5

2 Then came the introduction of new regulatory demands in the risk management space. He recalled the Turnball guidance, placing the owness and responsibility on Boards of the annual review of their principal risks, in addition to the Corporate Governance regime, all fuelling the fire. This continued to gather pace in banking through Basel II increasing sophistication on quantitative and financial aspects of risk. All of this evolution is not purely focused on regulation and started to promote thinking on how financial institutions should optimise their risk based capital to enhance business value. Having worked for 2 of the Big 4 consulting firms our guest speaker had the opportunity to work in a CRO role on secondment, having to take his own medicine on all of the advice he was giving as a consultant. This was not a light touch CRO role, with an annual budget of 43m, 400 staff and responsible for banking and insurance. Prior to taking the role, the organisation had re-cycled people into a CRO position from the business, more of a staging post for a General Managers career development. This way of appointing CROs had to change due to the fact that the role had become highly specialised. Becoming a CRO changed his outlook, and when asked What keeps you awake at night? he could now talk nonstop for 40 minutes, the list was very long indeed but his CEO wanted to know the risks that were not in his reports, the Black Swan events. He then realised he would have to step up from all the things he had been preaching and practice them at a different level. He recalls a particular situation with an insurer who was underwriting PPI for one of the main clearing banks and the main question was What level of risk, do you take into the Boardroom? He then continued in saying: We looked deep into the bank and how it was selling PPI and ultimately didn t agree with them as it didn t fit with our ethical values. We had to ask ourselves if we wanted to be associated with this line of business. Not an easy decision in light of millions of pounds on the bottom line of the P&L. Do we take the reputational risk, which may come back to haunt us, or do we give up? In the end, the Board decided to walk away, looking back that was the right decision underpinned by risk management. The Walker Report clearly recommends that the Board should be served by a CRO and served by a Risk Committee which the CRO attends. Since its publication there s been no going back, risk had gone up a notch, both in banking and other financial services sectors. In insurance, Solvency II requirements state that the risk management function report into the Board on the risks they are facing or could face. The FRC (Financial Reporting Council) has come out with its new corporate governance code on the ongoing review of the system of risk management within an organisation, as opposed to just reviewing annually, placing the responsibility on Boards to get the culture right in terms of the way they operate. Page 2 of 5

3 When you say Chief you are immediately talking C-suite, meaning you have to operate at a certain level within the organisation to deserve the title of CRO. A CRO has to be analytical but they must combine this with commercial, strategic, leadership and communication skills, it s no longer sufficient to be just a good quantitative, or qualitative person. A CRO is a very tall man or women, with their feet firmly on the ground and their head in the clouds. As a CRO you have to be prepared for a robust and constructive challenge with your NED group as well as your Executives. Our guest speaker canvassed opinion from his fellow NEDs on What they look for in a good CRO? and they concluded the following; Board training on risk topics, monitoring adherence to risk appetite and providing expert opinion in real life situations, a business partner in decision making rather than a reactive control agent, manage the Regulator and provide the right answer with a degree of humility, the ability to lobby on Regulatory developments to shape thinking moving forward and able to see the wood for the trees by not throwing everything in to the risk framework. The CRO is a superman specification, and it s getting harder and harder to find the right candidate. In the insurance sector you may take Actuaries and put them into the role, but they find the political element of the role hard to handle, which is not something that comes with actuarial training. In banking, the evolution to the CRO may come through lending with a narrow view of life. Do you develop, recruit or is there some other approach? Our guest explained that he s been mentoring a CRO for 7 years, and it s only now where he feels confident enough to step away, hence a big investment for the individual and the firm. When looking at recruiting a business person in the role, the question is: Is it acceptable to the regulator, the Board and how much of a risk do you run in doing that? With all this in mind: What is the career path for a CRO? Do you line them up for career progression, perhaps into a CEO role? Our guest speaker s prediction moving forward is that the new specification for the CRO is here to stay, it is not going to go away and we are going to have to work pretty hard as firms, Boards and executive management to enhance the gene pool, ensuring we have the right talent in place to match off against a higher expectation. Following our guest speaker s talk, our first observation was from a CRO at a global commercial insurer on the image of the tall person with their head in the clouds and feet on the ground spanning stochastic modelling to strategy at the Board table was a very striking one. His recent experience getting ORSA Board approval for the European company at the same time as the US parent constructing their very first ORSA has never generated so much intense debate. Our guest speaker went on to comment: There is a big difference between ORSA documents depending Page 3 of 5

4 on the individual firm, ranging from 30 to 500 pages, acting as a compendium where you can go and reference certain things, and very much a document to be actively used, not just put on the shelf once completed. The CRO is a superman specification, and it s getting harder and harder to find the right candidate A guest who is a CRO at a global insurer explained that her organisation is producing seven ORSA documents across multi-jurisdictions and their NEDs actively use the document, supported by a process summary and questions, in advance from the CRO. This enables her to use the ORSA document to actively engage the Board in addition to securing approval. A senior HR professional asked the question: What should our focus be on the training and development of our future CROs? Our speaker said: We have to start with the job specification and identify where the gaps are and then plug those gaps. However, it does depend on your starting point, if you have someone who is very quantitative, the softer skills may need more investment, as opposed to a more qualitative individual who may require more development on the deep technical side. There is a lot of continuous practical development that needs to happen and it s hard for someone in isolation to do this as it requires a sharing of ideas with fellow CROs in a networking forum or with a dedicated mentor. A guest who is an NED with a major bank shared his observation on the direct reports of a CRO, who are typically Heads of; Credit, Operational and Market Risk. He asked In such a narrow structure, where do the next generation of CROs come from? We need to work closely with HR to enable people from an earlier stage to cross discipline or we end up with a whole bunch of fantastic risk category people but nobody to flow through in to the very top layer, resulting in a very small and revolving pool of CROs. An NED with a portfolio which spans Asia and Europe, commented that she was surprised in the relatively new perspective around the CRO participating in Board level discussions, comparing her experience to Scandinavia, where the CROs have been providing a high level of guidance and prominence for many years. What is not on the risk register? This question resonated with an NED who has a portfolio of 5 organisations, including life insurance, going on to say that Bad behaviour doesn t seem to be on the risk register in large corporates and is a fundamental risk to all businesses. Do CROs have the skill set and antenna to recognise bad behaviour and if the answer to this question is Yes, what do they do about it? He shared the example of RBS during the acquisition of ABN Amro and imagined how a CRO would cope with that behaviour and burden placed upon them? The NED from a bank highlighted the requirement for the CRO to have full Page 4 of 5

5 support from the Board to make sure the CRO has full empowerment. A CRO at a Lloyds of London insurer went on to talk about permissions of the CRO role, explaining that she has seen the role evolve across different industries over the past 15 years. Permissions to do risk assessments, which have very clear recommendations, whilst getting your executive peers and the Board behind you, one must expect inevitable pushback and be ready to defend your corner. You must get used to the level of pain that comes with the CRO role, and mentoring has helped significantly. An NED from a bank referred to the PRA (Prudential Regulation Authority) document, and questioned if it gave any empowerment at all from a legal perspective. He was CRO for a Danish bank in one of his previous roles, where it was crystal clear in the Danish Banking Regulation that a CRO has a power of veto over any risk taken in point of law. A CRO from a retail financial services lender drew the parallel to being an international diplomat, keeping his Chair of the Risk Committee fully informed, in addition to regular 1:1s with his CEO, articulating the same information but in slightly different ways, ensuring the right outcome. The CRO from the Lloyds of London insurer said It s very important you do not dilute your Executive Peers operational responsibility or power base. Her most important relationship currently sits with the Chief Underwriting Officer, and negotiating change with that individual, who has typically devolved powers to the CRO over recent years. Do CRO s have the skill set and antenna to recognise bad behaviour? Summary It s clear the prominence and vital role the CRO plays at Board level, right through to the front line of the business, has significantly evolved over the past 15 years. Winning the hearts and minds of the people has become a vital part of the CROs effectiveness within an organisation, being able to derive business value from an everincreasing regulatory environment. Regulation continues to be a key challenge for the CRO, in most cases managing the PRA and FCA relationships with humility, whilst taking a proactive stance in shaping regulation into the future. With the added strategic, commercial, communication and leadership dimensions to the role, Boards continue to debate what route to take when recruiting a CRO, no longer reliant on the established and traditional camps in financial risk, for instance. General consensus across the Board and Executive is one of support and empowerment for the CRO. Not simply viewed as a control agent, but someone who the business can turn to when making important decisions across the organisation. Page 5 of 5