Interim Chief Risk Officer — Controls

The calls an independent risk officer cannot avoid

Independence in risk is not a box on an organisation chart. It is a series of moments when the risk function says no to something the business wants, and the no holds. The Interim Chief Risk Officer, accountable to the Group Chief Executive Officer for 24 months, will meet several of those moments early. The first is whether to let a major commitment proceed while its risk is still being understood, or to stop it and absorb the frustration that follows. The officer's first notable result could well be exactly that: a commitment halted and justified on evidence, with nothing new launched to show for it.

The second is where to draw the line between what local leadership decides and what the risk function must see. Drawn too tight, challenge turns into bureaucracy; drawn too loose, it becomes decoration. The CRO holds executive authority to agree those thresholds, to define the evidence the organisation uses to judge investment, operating capacity and the controls around them, and to rule on which inherited commitments carry on. The third call arises whenever a proposal would leave another unit carrying cost or risk it never agreed to. The CRO can block them, can reject investment cases that say nothing about take-up, operating dependencies or what could go wrong, and then approves how issues are escalated from there. The fourth, particular to an organisation owned by its members, is how to keep challenge independent while staying close enough to members' interests to be heard.

What two years of independent challenge should produce

Within ninety days, the Group Chief Executive Officer and the CRO should agree the organisation's risk appetite, who decides which risks at which level, and a written mandate for independent challenge that operating leaders have seen and accepted. Around month nine, that challenge should have been tested on real, major commitments, and every open exception should have a single accountable risk owner. By month 24, an independent risk function should be embedded, with assurance testing and reporting to the committee running in a way the organisation can sustain beyond the interim term.

A risk leader who has held the line before

The risk functions you have led sat in businesses turning over $430 million or more, with 2,400 or more people in at least three countries. Regulatory remediation is the first experience we will explore, especially any occasion when you had to change authority, funding and operating rhythm while operations kept running. Joint venture and turnaround experience will be examined too, the former because shared control is where independent challenge is hardest to keep. Expect close attention to risk judgement at level 4, and, at level 3, to risk appetite, assurance testing and regulatory engagement. You can describe an open gap to a Group Chief Executive Officer and still decide on time, and you want the outcome to be yours for the whole 24 months.

Who you will meet, and what they will probe

The Group Chief Executive Officer holds the first conversation, one to one over video, during the opening week, about what independence should mean day to day. Week three is spent with the Risk Committee Chair, working out how you would set appetite and report challenge. In week five the executives who run each function meet you in person, the people whose proposals you would be challenging. The process ends in the seventh week before the full board. Each stage receives our response in writing within four working days.