CRO – Enterprise Risk — Upstream Portfolio

The mandate

An institutionally backed upstream group is entering an asset-integrity programme while risk governance remains distributed across operations, technical authorities, projects, finance and regional teams. Each forum sees part of the exposure, but aggregation is slow and escalation thresholds are inconsistent. The next planning cycle cannot sensibly allocate inspection, maintenance and remediation capital without a more coherent view of consequence, uncertainty and control effectiveness.

The CRO will cover an approximately NOK 36,700 million operated asset and trading portfolio and a wider workforce and partner perimeter of around 2,250 people. The risk universe includes major-accident hazards, wells and asset integrity, project execution, cyber-physical systems, contractors, commodity and liquidity exposure, sanctions, supply continuity and organisational capacity. The function must challenge the business without becoming a parallel operator.

Reporting jointly to the Group Chief Executive and the relevant board committee, the appointee will establish independent risk insight, reliable escalation and sustained remediation. Stavanger presence is essential because judgement must be informed by assets, technical authorities and frontline evidence rather than remote consolidation of registers.

Why this seat is open

This is planned new hiring within an approved governance model, not a replacement. Current risk and assurance leaders retain their responsibilities until activation, but no executive presently owns enterprise aggregation or direct board challenge across the upstream portfolio. A four-to-six-month search allows the board to assess industry risk leaders and adjacent high-hazard candidates before the following capital cycle.

What you will own

• Define enterprise risk appetite and tolerances in terms that asset, project, trading and functional leaders can apply to real decisions.
• Create a common taxonomy linking hazards, causes, controls, exposure, ownership and capital response without flattening technically different risks into one score.
• Establish escalation triggers for integrity degradation, repeated control failure, overdue remediation and uncertainty that exceeds decision authority.
• Provide independent challenge to inspection, maintenance, well and project plans, testing whether deferral logic recognises cumulative and interacting exposure.
• Rebuild board reporting around movement, concentration and decision need rather than static heat maps or large inventories of low-consequence items.
• Clarify the boundaries between first-line ownership, technical authority, risk oversight, internal audit and external assurance; close gaps without duplicating testing.
• Commission deep dives where data quality or optimistic closure reporting makes the residual risk unclear, following remediation through independent validation.
• Develop a risk leadership bench capable of working credibly with engineers, asset directors and capital committees while retaining escalation courage.

The first 12 months

In the first 90 days, visit representative assets, examine the most consequential integrity decisions and trace how evidence moved from frontline observation to the board. Reconcile overdue actions, temporary repairs, impaired safeguards and risk acceptances across systems. Agree with the committee which uncertainties require immediate independent review.

By month six, implement a common escalation and acceptance framework and reset ownership of the highest-consequence exposures. Select a small number of control families for effectiveness testing, including contractor-dependent controls and barriers whose health is inferred rather than directly measured. Establish a confidential route for technical dissent.

Months seven through ten should integrate the risk view into capital and operating planning. Remediation proposals must state risk reduction, delivery confidence, dependencies and the consequence of delay. Train leaders to recognise cumulative exposure across assets rather than defending individual exceptions in isolation.

At twelve months, the board should receive an enterprise view that is timely enough to alter decisions. High-priority remediation must show independent evidence of sustainability, and aged escalations should be rare, visible and subject to explicit committee acceptance rather than administrative extension.

What the board will measure

• One hundred per cent of top-tier integrity exposures assigned to an accountable executive, dated action path and explicit acceptance authority within 90 days.
• A 40% reduction in overdue high-consequence remediation, excluding actions whose scope was strengthened after independent review.
• Control-effectiveness testing completed for the ten most material barrier families, with failed assumptions reflected in capital plans.
• All threshold breaches escalated within prescribed times and no material event preceded by information withheld from the correct forum.
• Board risk papers issued on schedule with decision requests, movement and uncertainty clearly distinguished for three successive cycles.
• Ready-now cover for 70% of the CRO’s direct reports and retention above 90% among designated technical risk specialists.

The person

You are a CRO, Risk Director or senior controls executive with 18–22 years in upstream energy, chemicals, utilities, mining or another high-hazard regulated environment. You understand barrier management and operational risk but can also integrate financial, project, cyber and geopolitical exposure. Your examples must include a moment when independent challenge altered an operating or capital decision.

Candidates need ownership of at least NOK 21,300 million in P&L, book, budget or accountable portfolio and leadership of 1,575 or more people. You have reported directly to a board committee, managed disagreement with operating executives and commissioned assurance where management evidence was incomplete.

This is an onsite Stavanger position with international relocation support. The CRO must maintain proximity to assets and technical leaders while preserving independent access to the board.

Compensation and terms

The anticipated package is NOK 4.2–5.8 million base plus annual incentive and LTI. Long-term awards will follow customary vesting, risk, conduct and performance provisions. Final terms reflect scope and current mix, with up to six months available for a responsible notice transition.

Confidentiality

The group, assets, integrity findings, assurance records and committee materials are confidential. Identifying access is restricted until qualification, reciprocal interest and formal confidentiality arrangements are complete.