Why today’s banking CRO must be master of many trades

The EY/IIF global risk management survey results surface new challenges faced by today’s CRO as their strategic and tactical remit expands.

In brief

• The CRO role has expanded and evolved to incorporate more issues even as the pressure to operate the risk function efficiently has intensified.
• Cyber is again the top risk priority for CROs, with heightened threats from more sophisticated attacks and proliferating vulnerabilities.
• To manage today’s risks and stay ahead of tomorrow’s, CROs seek more critical thinking skills, stronger analytics and increased organizational agility. 

With banks around the world facing an ever-growing volume and variety risks, chief risk officers (CROs) find themselves wearing more hats and engaged with a broader range of issues. The results of the 13th annual survey of banking CROs conducted by EY and the Institute of International Finance (IIF) demonstrate how the intersections of different risk types and the persistent volatility of the banking landscape demand versatility from senior risk leaders.

This year’s study points to the dynamic nature of banking risk management today. Financial risk has moved back up the CRO agenda after a few years of relative calm. Cyber threats morph constantly with evolving links to geopolitical, technology and third-party risks. New regulatory requirements and ambitious transformation programs also demand CROs’ attention. And CROs are also expected to direct finite resources to boost both the efficiency and effectiveness of the risk management function.

For these reasons, the CRO job description has become uniquely multi-faceted. Insights from the research reveal seven roles CROs must play in identifying risks accurately, managing them effectively and reporting on them efficiently.

1. Fortune teller: envisioning risk impacts against a wide range of scenarios

There is almost no end to the questions CROs must ask to get ahead of emerging risks. What will regulators focus on next? Which jurisdictions are most likely to take action on ESG or consumer protections? What form will cyber attacks take when quantum computing power is more widely available? What economic and geopolitical developments could expose our business? Is our transformation agenda bold enough for future customers? The survey results show just how broadly CROs must think when they consider future risks.

3. Firewatcher: monitoring vigilantly to prevent emergencies

Cyber tops the list of immediate-term CRO and board concerns by a large margin and may remain there for years to come. Cyber is actually a portfolio of multiple risks, including different forms of ransomware attacks, expanding activity by state-sponsored bad actors and the risks associated with ecosystems, generative AI (GenAI) and other third-party relationships. Thus, advanced and constant monitoring must be the baseline for cybersecurity. CROs must also be vigilant about the rise in fraud and other financial crime caused by economic stress.

4. Transformative technologist: building a framework for safe transformation

Banks have significant digital transformation programs underway as they seek to modernize their infrastructure, keep up with consumer expectations and stay ahead of competitors. In many cases, they are looking to accelerate these initiatives, despite significant constraints, including limited resources and competing priorities.

CROs need a clear understanding of both the overarching business objectives and the unique risks presented by powerful technologies, including GenAI. The use of machine learning and AI was cited by survey respondents as the second most important emerging risk for the next five years.

The specific risks range from unintended bias in decision-making, to increased cyber vulnerability, to staying ahead of potential new regulatory requirements.  To manage these risks effectively, banks will need new skills and technology experts; 61% of survey respondents said talent is a key risk to establishing oversight capabilities for emerging tech.

5. Data guru: protecting and providing strategic guidance around the bank’s biggest asset

Data is critical to every part of the business, as CROs recognize. High-quality and highly secure data is necessary to manage through increasing regulatory requirements and to unlock business growth through increased customer insights. CROs have as much responsibility as anyone to secure these critical assets, especially as they move among partners and ecosystems.

The key is to provide strong protections while also supporting the ability of the business to use data fluidly and intelligently (e.g., via personalized customer experiences). The good news: a strong majority of CROs – 71% – say their banks are actively enhancing their data capabilities and frameworks.