Wednesday, July 22, 2009

Some thoughts on the Walker Review (continued)

The independence of the chief risk officer (CRO)

It is imperative that a CRO be insulated from business line, or other, pressures that would cause him or her to give biased, incorrect, or incomplete information to the board. While various methods can be proposed for accomplishing this, the review suggests that the CRO should report directly to the risk committee (with an internal reporting line to the CEO), and be completely independent of the business lines. Additionally, removal of the CRO and the CRO’s compensation would be subject to approval by the board. This arrangement will provide a degree of independence for the CRO, although dual reporting responsibilities will make it difficult to prevent the CRO from being completely insulated from pressure by the CEO.

Additionally, the review was largely silent on the issue of the process for hiring the CRO. If the hiring is done by the CEO, either from internal or external candidates, some degree of the wanted independence may be lost. However, if the board is in charge of the hiring (or has approval power over the hire), current boards may not feel up to the task of rigorously evaluating the credentials of a CRO candidate and may rely heavily on senior management’s recommendations - again possibly losing a degree of the sought-after independence. Hopefully, over time, as board’s skills and confidence in risk management improve, this may become less of an issue.

Posted by William May, Senior Analyst

2 comments:

Unknown said...

yes I agree. The Risk Managers should be kept isolated from Risk Takers.But regarding the compenstion issue,What i am not able to make out, is that how to evaluate the performance of RM?Business line can easily find out its value add to the business i.e Profit unlike Risk Managers which dont have any such benchmark to back their performance.But yes it is critical that CRO shuold enjoy independance like Internal Auditor.I think CRO should not come under CEO's Repoting line because CEO is 1)Business Person 2) Is under pressure from interested parties to perform and also sometime only an employee (executive) of the company looking to maximize his interest as indicated by agency theory.

Unknown said...

Yes I agree. CRO should be as independent as an Auditor is.The Risk Manager should not come under any influance of Risk Taker.What I think CRO can be hired by Either 1)Risk Committee dealing with the compansation etc of the CRO. or 2)Can be hired by an outsourced firm appointed by Risk Committee with a defined compansation range so as to make the process flexible.CRO should directly report to Risk Committee and should not have any repoting relationship with CEO other than through Risk Committee.But a dilemma is that how to determine the performance of the CRO? Business Lines can easlity demonstrate their performance through Profits unlike Risk Managers so can any one inform me about this?