The Board Imperative: Champion CROs to boost risk governance and growth

1. Crystalize risk management expectations

To propel the CRO, it is important to outline the board’s risk management expectations. The survey data outlines four key areas where there is significant opportunity for improvement, which require the following actions:

Take a holistic approach to risk management

Boards want a holistic approach to risk management that incorporates both emerging and traditional risks. However, just 39% of boards today believe their organization’s risk management capabilities are more than moderately effective at managing both atypical and emerging risks.

Identify opportunities in risk

Boards require executive management to better identify opportunities that lie in risk. For example, if a new competitor emerges and secures a new venture funding round, this development might be included as part of the wider reporting on competitive risk.

However, in this example, this business also presents an opportunity from the board’s perspective, as an acquisition target or a potential strategic partner. Therefore, boards must adequately challenge executives, including the CRO, to identify these “upside risks”, and consider how they might be reframed as opportunities.

Interlink risks with secondary impacts

Boards want CROs to better assist executive management in considering how risks are interlinked and identify potential second-order impacts. For example, climate change presents interconnected risks for businesses related to operations, supply chain, customer base displacement and reputation, assuming limited action.

Boards identify this as a key area for improvement. However, only just over half (52%) say their risk management capabilities are more than moderately effective at understanding how different risks are interconnected.

Consider a wide range of stakeholders

Boards expect executives, including CROs, to consider the objectives of a broad set of internal and external stakeholders when assessing risks as part of business decision-making. Through doing so, the outcome expected is the elevation of the importance of risks like climate change and ESG factors, therefore enabling boards to challenge management on key topics, such as how supply chain partners are decarbonizing their operations.

In the financial services sector, there is already evidence that ESG risk factors are increasingly considered in business decisions. For example, 48% of CROs within banks say ESG is embedded in their loan decisioning processes.  

In addition, boards should also ensure that CROs (or their equivalent) are fully aware and are kept updated of the business’ strategy and long-term ambitions, sharing any insight about emerging megatrends that might impact the business. This is a crucial input to assist executive management to mitigate downside risk and capture “upside” opportunities.

3. Champion the CRO

Many businesses in non-regulated sectors do not have a formal CRO as part of their C-suite. As the demands on risk leaders intensify and the need for collaboration with executive management and the board grows, boards might challenge businesses that do not currently have a CRO to consider formalizing the role in their C-suite.

However, just as important is the mandate and responsibility that this individual is given. Boards should ensure through their executive management teams that the CRO is sufficiently empowered within the organization and connected with other senior executives through clear and open channels of communication.

For example, instead of communicating risk exposures separately during scheduled board meetings, the board should insist that risk and opportunity assessments are integrated into regular management reporting vehicles. These can be strategies, business plans, operational performance reports and investment proposals.

Robust governance in the form of a risk sub-committee (where not already mandated) may also be necessary to align and calibrate expectations and progress in line with the organizations risk management framework; thus helping to build risk management capabilities.  Importantly, these committees should ensure their composition is adequate to cover a wide range of newer risk topics such as technology, sustainability and talent.

Key questions for boards to consider

Boards have an important role to play in onboarding a CRO or enhancing board-CRO relations in order to support their business’ new growth and transformation agendas. With that context, here are some key questions that should be front of mind:

1. If you don’t already have a CRO in the C-suite, given the increasing complexities of risks, should you revisit the need with the CEO? If you do have one, are you doing enough to empower and embolden them in your discussions and interactions with the executive management teams?
   
2. Have you been clear with your executive management team what you expect from your CRO when it comes to challenging them?  Have their responsibilities been clearly communicated? Do they have enough exposure to and a sound understanding of the business strategy to be asking the right questions?
   
3. How do you ensure that the CRO does not dilute executive management accountability for all aspects of doing business, including monitoring risk exposures, effectiveness of controls and reporting relevant outcomes to the board?
   
4. Are you regularly consulting with your CRO on how executive management can be better equipped and informed to take advantage of new technology, data and managed services to improve their risk-based decision-making processes?

Summary

Increased collaboration with the CRO (or equivalent) is crucial to help set boards up for success in mitigating increasingly complex risks and staying ahead of the competitive landscape. Boards can achieve this by clarifying their expectations, encouraging a digital-first approach to risk management, and formalizing and empowering the role of the CRO as a key C-suite contributor.