Independence with influence: why a merely respected risk function has already failed

The wrong compliment#

Ask an executive committee what it thinks of its risk function and the answer is often that it is well respected. It is meant as praise. It should be heard as a warning, because respect is what an institution pays to a function it has learned to live with — consulted when required, documented when necessary, and routed around when it matters.

A risk function that is merely respected has already failed. The chief risk officer’s mandate is to be heard before the decision, not recorded after it, and no amount of respect substitutes for that.

What independence is, and what it is not#

Risk function independence means one thing: the CRO’s assessment of a risk cannot be overruled by the business that wants to take it. It is protected by a reporting line that reaches the board, by the CRO’s standing in the risk committee, and by the institution’s habit of hearing dissent from the seat without treating it as disloyalty.

What independence is not is distance. A CRO who protects independence by staying out of the rooms where decisions form has chosen exile, and an exiled second line is independent of everything, including the outcome. The standing apart the seat requires is standing apart inside the room.

The symmetrical failure#

The seat is lost in two directions, and both feel like success from the inside.

• Trading independence for influence: the CRO becomes the chief executive’s risk adviser — in every meeting, trusted, consulted early — and gradually unable to say the thing the chief executive does not want to hear. Influence is total and the second line has ceased to exist.
• Trading influence for independence: the CRO becomes the office of no — unimpeachable, rigorous, and absent from the conversations that matter, because nobody invites the person whose only word is no. Independence is total and nobody is listening.
• Holding the line between the two: partner and check at once, close enough to be heard early, apart enough to be believed when it counts. This is the seat, and it is not a position one arrives at; it is a position one holds daily.

The operational test#

There is a simple way to know which side of the line a risk function is on. When did the CRO learn of the last material decision — before it was taken, in the room where it formed, or afterwards, when asked to document it? If the answer is afterwards, independence is intact and the mandate has failed. The paper trail will be impeccable and the institution will have decided without its second line.

If the CRO learns of a decision when asked to document it, independence is intact and the mandate has failed.

If the CRO learns of a decision when asked to document it, independence is intact and the mandate has failed. The remedy is rarely a change of policy. It is a change of presence — the CRO in the rooms where decisions form, early, with a view the business can use rather than a verdict it must survive.

Spending the veto without spending the seat#

Where a veto exists, every use of it draws on the same account as the CRO’s influence. Spent rarely, in the open and with the numbers, a veto strengthens the seat: the institution learns that the second line means what it says. Spent often, in private or on instinct, it empties the account, and the CRO who has vetoed three times is not invited to the fourth conversation. The CRO who is in the room early enough seldom needs the veto at all, which is the quiet proof that independence and influence were never opposites.

What a CRO does with this#

Start with the test: name the last material decision and say honestly when the seat learned of it. Then look at the rooms — which ones the CRO is in early, which ones only afterwards — and at the reporting line as it operates under pressure rather than as it is drawn. Independence with influence is a craft rather than a setting, and it is the craft The CRO Mandate is built around.