CRO – Enterprise Risk — Upstream Portfolio

The mandate

The next planning cycle has brought into focus risk governance failing to keep pace with regional complexity within a institutionally backed integrated energy producer and services platform. The immediate arena is the upstream portfolio during an asset-integrity programme. For mandate 393, the successful executive inherits decisions that have been deferred, competing stakeholder expectations and a need to establish facts before committing further capital.

The CRO – Enterprise Risk operating perimeter covers approximately NOK 36,700 million in operated asset and trading portfolio, with activity spanning several upstream portfolio customer, product and delivery clusters rather than a single asset. The CRO – Enterprise Risk Oil & Energy remit carries direct influence over roughly 2,250 colleagues and third-party capacity.

The board and its investment committee want a CRO – Enterprise Risk who can convert ambiguity into a short list of explicit choices for the upstream portfolio. The CRO – Enterprise Risk Oil & Energy seat must resolve an asset-integrity programme, while preserving the underlying strengths of the upstream portfolio. For mandate 393, value will come through sharper allocation, stronger leaders and an operating cadence that exposes variance early.

The CRO – Enterprise Risk’s first year on the upstream portfolio is expected to end with risk transparency, decisive escalation and sustainable remediation. In mandate 393, authority covers resources and leadership appointments; material trade-offs go directly to the board sponsor.

Why this seat is open

This is a newly created CRO – Enterprise Risk — Upstream Portfolio seat approved as part of the next operating model; it is not an incumbent replacement. The board is running a planned 4–6 month search so the appointee can join ahead of the next capital and talent cycle. Current leaders retain their existing accountabilities until the upstream portfolio remit is formally activated. Confidentiality protects organisation design choices while the board compares external and adjacent-sector talent.

What you will own

• Set the CRO – Enterprise Risk value-creation thesis for the upstream portfolio, translate it into no more than five enterprise priorities and stop work that does not support them.
• Carry stewardship of approximately NOK 36,700 million in operated asset and trading portfolio, including allocation, risk acceptance and board forecasts.
• Lead the CRO – Enterprise Risk Oil & Energy organisation of about 2,250 employees and partners, appointing a team with clear decision rights and credible succession for every critical seat.
• Resolve the upstream portfolio economics and execution constraints created by an asset-integrity programme, with CRO – Enterprise Risk-approved owners, dated milestones and transparent escalation thresholds.
• Establish one CRO – Enterprise Risk operating review across commercial, customer, financial, people, technology and risk outcomes for the upstream portfolio; remove reconciliations that obscure accountability.
• Have held independent challenge authority and closed material issues with evidence accepted by board or supervisory review in mandate 393.
• Build the CRO – Enterprise Risk’s three-year succession and capability plan for the upstream portfolio, reducing dependence on individual executives and improving mobility across the wider Oil & Energy organisation.

The first 12 months

• Days 1–90: Validate the upstream portfolio baseline, meet the 30 stakeholders most consequential to risk governance failing to keep pace with regional complexity, assess the leadership team, stabilise immediate delivery risks and agree a board-owned scorecard with explicit decision gates.
• Months 4–9: Make the principal CRO – Enterprise Risk portfolio and organisation choices for the upstream portfolio, install the new operating cadence, fill critical leadership gaps and deliver the first measurable release of cash, capacity or customer value.
• Months 10–12: Demonstrate a repeatable upstream portfolio trend against risk transparency, decisive escalation and sustainable remediation, lock the following year’s capital and talent plan, evidence control sustainability and present a credible three-year value case with downside actions.

What the board will measure

• Delivery of the CRO – Enterprise Risk’s agreed first-year upstream portfolio value case within a 10% tolerance, with variance explained before rather than after the relevant quarter closes.
• A CRO – Enterprise Risk forecast that remains decision-useful across three consecutive quarters and reconciles the upstream portfolio’s operating, cash, customer and people assumptions.
• Closure of the CRO – Enterprise Risk mandate’s highest-priority upstream portfolio risk and execution issues by their board-approved dates, with independent evidence that fixes are sustained.
• Retention of at least 90% of critical upstream portfolio talent and ready-now successors for at least 70% of the CRO – Enterprise Risk’s direct reports.
• A quantified CRO – Enterprise Risk-owned improvement in the upstream portfolio operating constraint behind an asset-integrity programme, supported by a clean baseline and named data owner.
• Clear stakeholder confidence in mandate 393: no unresolved high-severity escalation older than 30 days and no material surprise withheld from its agreed governance forum.

The person

You are currently a CRO, Risk Director or senior controls executive in a institutionally backed Oil & Energy or adjacent enterprise. In relation to the upstream portfolio, your CRO – Enterprise Risk track record includes a transition where the original plan was no longer sufficient; you can explain your choices, evidence and numerical impact. Candidates from energy, oil and gas, utilities, chemicals, renewables or industrial services will be considered where the operating model, customer stakes and governance intensity match this CRO – Enterprise Risk brief.

As a CRO – Enterprise Risk candidate, you bring 18–22 years of progressive Oil & Energy or adjacent-sector experience, consistent with the 18-22 experience band. At minimum, you have carried a P&L, book, budget or accountable portfolio of NOK 21,300 million and led an organisation of at least 1,575 people.

For mandate 393, the board wants two transitions: a difficult upstream portfolio portfolio choice and a leadership-system change during an asset-integrity programme. As the prospective CRO – Enterprise Risk for this upstream portfolio, you must challenge optimistic cases and still create followership. References for mandate 393 must distinguish your contribution from the institution around you.

The CRO – Enterprise Risk must be based in Stavanger; international relocation is supported, but this Oil & Energy role is not designed as a remote appointment.

Non-negotiables

• Current or recent accountability at the level of CRO, Risk Director or senior controls executive, with direct exposure to a board, investment committee or equivalent Oil & Energy governance forum.
• Proven CRO – Enterprise Risk ownership of at least NOK 21,300 million and leadership of no fewer than 1,575 employees in a comparable upstream portfolio context.
• One completed Oil & Energy or adjacent-sector example of risk governance failing to keep pace with regional complexity with outcomes sustained for at least two reporting periods after the initial intervention.
• Sector credibility from energy, oil and gas, utilities, chemicals, renewables or industrial services; experience that is purely functional and lacks CRO – Enterprise Risk-level upstream portfolio consequences will not meet the bar.
• Willingness to meet the Stavanger location expectation, complete conflicts and background diligence, and protect the confidentiality of mandate 393.

Compensation and terms

The anticipated CRO – Enterprise Risk package is NOK 4.2–5.8 million base + annual incentive and LTI, calibrated to the final upstream portfolio scope and the candidate’s current mix. Any long-term participation for mandate 393 follows standard vesting and performance conditions. The CRO – Enterprise Risk appointment in Stavanger, centred on the upstream portfolio, offers regular exposure to the board and its investment committee. A notice period of up to 6 months can be accommodated for the selected executive in mandate 393.

Confidentiality

This search is being conducted without naming the client for mandate 393. Identifying information will follow only when both sides elect to proceed under confidentiality; nothing in the published mandate should be treated as a clue to ownership or brand for mandate 393.