CRO – Enterprise Risk — Wealth Franchise

The mandate

An institutionally backed wealth franchise has acquired a regional business whose products, adviser model and control framework differ from the parent. Both organisations remain within their historic risk appetites, but no one can show the combined exposure across client concentration, investment products, credit, operations, technology and third parties. Regional governance has not kept pace with complexity, and integration decisions are proceeding without one transparent risk view.

The newly created CRO – Enterprise Risk will oversee approximately US$4,300 million in assets and risk and lead about 325 employees and material partners. The role owns appetite, aggregation, challenge, risk data, scenario analysis and board assurance. Compliance and internal audit remain independent peers; first-line leaders retain ownership of their decisions and controls.

The immediate choice is what to harmonise before legal or platform integration. Customer and product taxonomies, severity, exception authorities and escalation thresholds need a common basis. Local requirements may remain, but differences must be explicit and owned. The CRO should prevent temporary integration tolerances from becoming a permanent shadow appetite.

Wealth risks interact. A concentrated client may hold an illiquid product financed by credit while relying on one adviser and one external custodian. Registers that separate those exposures obscure the scenario the board needs to see. The executive will create connected views and exercise severe but plausible events.

Remediation must demonstrate sustainable operation. Closure evidence should prove that ownership, data and controls function after programme attention recedes. The CRO will prioritise the issues capable of changing appetite or client outcomes, rather than adding blanket assurance.

Risk culture will be tested through decisions, not survey sentiment alone. The CRO should observe how advisers, product committees and integration leaders respond when attractive revenue conflicts with incomplete evidence. Incentives, delegation and committee papers must make challenge and acceptance visible. Repeated late escalation should trigger a change in authority or operating design, not another communication campaign.

Third parties need integrated treatment as well. Custodians, investment platforms, data services and acquired suppliers may support several products while being assessed separately. The CRO will aggregate concentration, continuity, information-security and exit exposure, then ensure first-line owners exercise the scenarios most capable of interrupting client service.

Why this seat is open

This planned new role is part of the post-acquisition operating model. The board has allowed four to six months for selection before the next capital and talent cycle. Existing leaders retain their accountabilities until the integrated remit begins.

What you will own

• Establish combined appetite across customer, product, credit, operations, technology and suppliers.
• Aggregate connected wealth exposures and run decision-relevant scenarios.
• Govern integration tolerances with owners, expiry dates and consequences.
• Steward US$4,300 million of assets, risk acceptance and board forecasts.
• Create comparable risk data, severity and escalation across acquired entities.
• Challenge product, adviser, platform and partner integration decisions.
• Lead 325 employees and partners with independence and specialist succession.
• Give the risk committee early alternatives, not retrospective breach reporting.

The first 12 months

In the first 90 days, map the two appetites, material exposures, exceptions and remediation commitments. Meet the 30 stakeholders most consequential to integration, including clients represented through evidence, advisers, product heads, regulators and technology leaders. Test several connected scenarios, assess the risk team and agree board gates for product, data and platform convergence.

Months four to nine should adopt a common taxonomy, reset thresholds and close or time-limit unsupported differences. Fill leadership gaps, exercise a severe event and establish independent validation for the highest-risk remediation. The first value should appear in exposure avoided, duplicated assurance removed or faster, better-owned escalation.

By year end, risk transparency, decisive escalation and sustainable remediation should show consistent progress. Delivery must remain within 10% of the approved case, and forecasts should reconcile risk, cash, customer and people assumptions across three quarters. Priority issues require independently evidenced closure; severe escalations cannot remain unresolved beyond 30 days.

What the board will measure

• Completeness and timeliness of combined risk exposure by client and dependency.
• Frequency, age and expiry discipline of integration exceptions.
• Decisions changed through scenario analysis and second-line challenge.
• Remediation closure that remains effective outside programme governance.
• Retention of nine in ten critical risk specialists and ready-now cover for seven in ten direct-report roles.
• Quantified improvement in regional risk governance, backed by named data ownership.

The person

You are a CRO, Enterprise Risk Executive or substantial divisional risk leader with 18–22 years in wealth, banking, insurance, payments or regulated fintech. You have integrated risk frameworks after acquisition without confusing consistency with lowest-common-denominator control.

Your accountable P&L, book, budget or risk portfolio has been at least US$2,500 million, and you have led 230 or more people. You can evidence a risk-governance change whose outcomes survived two reporting periods after integration activity reduced.

You preserve independence while proposing workable choices. You can identify an exposure that becomes material only in combination and explain it plainly to clients, executives and the board.

Compensation and terms

Base compensation is US$430,000–575,000 plus annual incentive and equity. The permanent role is onsite in New York, supports relocation and permits notice up to six months.

Confidentiality

The client and acquired business will be named only after mutual confidentiality. Rounded facts cannot be used to triangulate either organisation.