What it means
Risk management in a large organisation is usually described as three lines of defence. The business units own and take risk, the risk function sets the framework and challenges the business, and internal audit independently checks that both are doing their jobs, with the chief risk officer leading the second line.
The remit covers several distinct categories. Credit risk is the chance that someone who owes money does not pay, market risk comes from price and rate movements, liquidity risk is running out of cash despite being solvent, and operational risk covers failures of people, process, systems and external events.
A large part of the role is translation. The chief risk officer converts scenarios into numbers the board can act on, using tools such as expected loss calculations, stress tests, value at risk and scenario analysis with quantified impacts.
Independence is what makes the position work. If the chief risk officer reports only to the executive whose revenue targets create the risk, the challenge is compromised, which is why the role usually has a direct line to the board risk committee.
The hardest part of the job is being unpopular at the right moments. The chief risk officer is the person arguing to reduce exposure while a market is still rising, and the value of that argument only becomes obvious after the market turns.
In practice
Real-world examples.
Example
A bank's chief risk officer runs a stress test assuming property prices fall 30% and unemployment rises by four percentage points. The results show the mortgage book would breach an internal capital limit, so lending criteria are tightened for high loan to value applications before the scenario arrives.
Example
An energy trading firm's chief risk officer sets a limit on the size of any single counterparty exposure at 10% of capital. When a large customer requests credit terms that would exceed the limit, the deal proceeds only with a bank guarantee covering the excess.
Example
A hospital group's chief risk officer maps the impact of a two day outage of the patient records system, quantifying cancelled procedures, agency staffing and regulatory exposure. The quantified figure supports investment in a secondary data centre that the board had previously deferred twice.
Formula
Calculation
Expected Loss = Probability of Default x Loss Given Default x Exposure at Default
Take a $20,000,000 loan facility where the borrower has an estimated 2% probability of default over the next year, and the lender expects to recover 55% of the balance in a default, meaning loss given default is 45%.
Expected loss = $20,000,000 x 0.02 x 0.45.
$20,000,000 x 0.02 = $400,000, and $400,000 x 0.45 = $180,000.
So the chief risk officer would expect $180,000 of loss on this facility over a year, and the loan needs to be priced so that the margin covers that $180,000 plus funding costs, capital costs and a profit. Across a portfolio of 50 similar facilities, expected loss would be 50 x $180,000 = $9,000,000.Case study
Seen in the real world.
The following is an illustrative, fictional example. Brackenhall Mutual, an invented insurer, discovered that 38% of its commercial property premiums came from a single coastal region because underwriters had been rewarded on volume rather than on the shape of the book. No individual policy looked unusual, and the concentration had never appeared on any single report.
The newly appointed chief risk officer built a concentration dashboard by region, peril and broker, and set a limit of 20% of premium in any one region. Reaching that limit meant declining renewals that were profitable in isolation, which was genuinely unpopular with the underwriting team. When a severe storm hit that coast two years later, the illustrative insurer's claims were roughly half what they would have been at the original concentration, and it remained comfortably within its solvency requirements.
Watch out
Common mistakes.
- Expecting the chief risk officer to eliminate risk. A business that takes no risk earns no return, so the goal is exposure that is understood, limited and properly priced.
- Letting the risk function report into the revenue side of the business. Independence is the mechanism that makes challenge credible, and without it the role becomes a rubber stamp.
- Confusing a risk register with risk management. Listing risks in a spreadsheet achieves nothing unless each one has an owner, a limit, a monitoring measure and an agreed response.
Questions
People also ask.
What is the difference between a chief risk officer and internal audit?
The chief risk officer designs and runs the risk framework as the second line of defence, while internal audit independently tests whether the framework works as the third line.
Is the role only necessary in financial services?
No, though it is mandatory there, and any organisation with concentrated exposures, complex supply chains or serious safety and regulatory obligations tends to benefit from the discipline.
How do you measure whether a chief risk officer is effective?
Look for surprises: a well run risk function means losses fall within the ranges already presented to the board, rather than arriving unannounced.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%