Board Renewal at Clevedon Bank
Clevedon Bank is a UK challenger bank with £3bn of assets. Its board has seven members: the CEO, CFO and COO as executives, and four non-executives. The chair was the bank's CEO until 2019 and moved to the chair in 2021. The senior independent director has served eleven years. The risk committee is chaired by a former finance director of the bank's largest outsourced IT supplier, a relationship that began in 2019 and continues. The fourth non-executive joined four months ago from a retail career and sits on both the audit and risk committees; the audit committee is chaired by the senior independent director. The CRO attends risk committee meetings but reports to the CFO, and has no direct line to the board. Board papers are circulated 48 hours before meetings, and the risk committee has met three times in the past year. A supervisor has written to express concern about the board's ability to challenge executive risk-taking, and the chair has asked for a candid assessment before the next board effectiveness review.
1. Assess the board's independence and composition against accepted corporate governance principles, identifying the three most serious weaknesses and explaining why each matters.
Read the worked answer
1. The chair is not independent and was previously the CEO. Good governance requires the chair to be independent on appointment, and a sitting or former CEO of the same company should not become chair: the chair sets the agenda, runs the board and appraises the CEO, so the role becomes structurally compromised when held by the person the board is meant to hold to account. The bank's entire challenge function is anchored on this role.
2. The risk committee chair has a live commercial conflict. A former finance director of the bank's largest IT supplier chairs the committee that oversees third-party and technology risk. Even with disclosure, this is untenable: the committee approves the risk appetite and receives outsourcing performance reporting on an entity the chair was financially accountable for. Conflicts must be managed by removal from the role, not merely by recusal on individual agenda items.
3. Independence has effectively collapsed through tenure and size. The senior independent director has served eleven years, beyond the point at which independence is presumed lost; that director also chairs audit. Of four non-executives, arguably none is independent - one is the ex-CEO, one has the supplier conflict, one is over-tenured, and one is new and inexperienced. With three executives on a seven-person board, non-executives can be outvoted and cannot form the majority the framework contemplates.
The supervisor's concern is therefore well founded: composition, not competence, is the problem. A board with no independent majority cannot credibly set or challenge risk appetite, and the regulator will treat that as a governance risk in its own right.
2. Recommend changes to the risk governance architecture, including the CRO's reporting line and the risk committee's operation.
Read the worked answer
CRO reporting line. The CRO reporting to the CFO is a structural defect: the CFO owns the numbers the CRO must challenge (provisioning, capital, valuation, liquidity buffers), and a functional report to an executive creates an incentive to soften bad news. The CRO should have a functional reporting line to the board risk committee and an administrative line to the CEO. In practice this means: appointment and removal subject to risk committee approval; objectives and remuneration set with risk committee input; unrestricted access to the committee chair; and the ability to escalate without executive filtering. Independence must also be protected in practice - the CRO should not hold a revenue-carrying role.
Risk committee composition and operation. The committee needs an independent chair, at least three members, and a majority of independent non-executives, with at least one member having recent and relevant financial and risk experience. The audit and risk committee chairs should be different people, and a conflicted member should step down, not merely recuse.
Meeting cadence and mandate. Three meetings a year is inadequate for a bank whose credit, liquidity and technology profile changes continuously. Move to at least five or six scheduled meetings plus ad hoc sessions, with private meetings between non-executives, the CRO and internal audit, and the ability to take independent professional advice. The standing agenda should cover risk appetite utilisation, the top risk register, KRIs and limit breaches, regulatory change, model risk, and periodic deep dives. Minutes should record challenge and dissent, not just decisions.
3. Explain why 48-hour paper circulation and three risk committee meetings a year undermine effective challenge, and what should replace them.
Read the worked answer
Both are structural constraints on challenge rather than administrative details.
A 48-hour window is not enough time for a non-executive with other commitments to read a substantial pack, identify the questions that matter, and seek an independent view. The practical consequence is that members arrive at the meeting having absorbed the executive summary and deferred to the presenters - the board becomes a ratifying body. Complex papers (credit submissions, model validation, capital forecasts, outsourcing business cases) need preparation time proportional to their complexity. Good practice is five working days as a minimum, with a hard rule that late papers are deferred unless genuinely urgent, and pre-meeting briefings or teach-ins for unfamiliar topics.
Three meetings a year means the committee sees the risk profile roughly quarterly while risks move daily. Between meetings, limit breaches, near misses and emerging issues accumulate without oversight, and the committee cannot track whether remediation it demanded has happened. Cadence should match risk velocity: at least five to six scheduled meetings, with a standing forward planner so members know what is coming and can prepare, and ad hoc meetings triggered by defined events.
Supporting changes matter as much as frequency: a concise dashboard with trend arrows and breaches highlighted before the pack, exception-based reporting rather than narrative, and a challenge log that tracks whether questions raised were answered. The chair should ensure the CRO and internal audit head are heard without the CEO summarising their views. Board effectiveness review should test whether challenge actually changed decisions, not whether meetings occurred.