Why Non-Financial Risk Is Redefining the CRO Role

Financial institutions should reconsider their assumptions about what makes an effective Chief Risk Officer because the risks shaping modern organizations increasingly extend far beyond credit, market, and liquidity exposures.

That was the view of a Chief Risk Officer at a UK-based bank, who argued that the growing importance of operational resilience, cybersecurity, financial crime, technology risk, and organizational culture is fundamentally changing the profile of the modern CRO.

Speaking at CeFPro's recent Treasury & ALM Europe conference, the risk executive suggested that non-financial risk expertise is becoming one of the strongest foundations for enterprise-wide risk leadership.

"Why would you have someone from non-financial risk as a CRO?" the executive asked. "That's what I'm going to explore."

For decades, the traditional route to the CRO position often began in credit risk. The financial crisis reinforced the importance of financial risk management, placing significant focus on capital adequacy, lending practices, and balance sheet resilience.

Yet the risk landscape has evolved dramatically since then.

The executive pointed to the growing prominence of operational disruptions, technology failures, cyber threats, geopolitical instability, artificial intelligence, environmental challenges, and societal risks.

Many of the most significant threats facing organizations today sit outside traditional financial risk disciplines.

Referencing global risk surveys, he noted that the highest-ranked emerging threats are increasingly dominated by non-financial concerns.

"Non-financial risk has really come to the fore," he said.

The shift has been reinforced by a series of high-profile industry events where operational failures rather than financial miscalculations became the defining issue.

Technology outages, governance breakdowns, conduct failures, and resilience weaknesses have all demonstrated that institutions can suffer severe financial and reputational damage even when traditional financial risk controls remain intact.

According to the executive, operational risk management develops a different set of leadership capabilities from those typically associated with more specialized risk disciplines.

While financial risk often focuses on analytical questions such as whether a borrower will repay a loan, operational risk requires organizations to examine broader questions around how processes, systems, people, and controls may fail.

"Credit risk is more prescriptive," he said. "Operational risk is - will this whole process break?"

That perspective requires practitioners to think across organizational boundaries and understand how different parts of a business interact.

The executive described operational risk as a discipline built around influence rather than authority. Risk leaders must persuade business units, technology teams, and operational functions to identify and address weaknesses rather than simply issuing directives.

"You learn to persuade," he said.

That experience can prove particularly valuable at senior leadership level, where effective communication and stakeholder management are often just as important as technical expertise.