CRO reporting line and a risk appetite statement that does not bite

Ranking test: which weakness most reliably stops the board from seeing and acting on a risk in time?

1. CRO independence. The CRO sits under the CFO, who owns the earnings forecast, the funding plan and the capital raise. Those are precisely the decisions a CRO must be free to challenge. Prudential governance expectations require the CRO to hold sufficient authority, independence and unfettered access to the board. A CRO who cannot escalate without passing the CFO is structurally compromised, and every other weakness below becomes harder to surface.

2. Breach discipline. Three breaches of the same tolerance in nine months, each closed when the metric drifted back, is a monitoring line, not a limit. A breach should trigger a documented root-cause analysis, a board report regardless of self-correction, and either a remediation plan or a formal board-approved reset of the limit.

3. Risk appetite design. 46 metrics with 31 reported half-yearly cannot be governed at the speed of the risk. Reporting frequency must match the volatility of the metric and the speed at which a breach can damage capital or liquidity.

4. Audit objectivity. The co-source partner advising on credit model development while auditing credit models is a self-review threat to external-quality assurance.

First change: move the CRO to a direct line to the CEO, with a reporting line and private sessions with the board risk committee, and strip profit-linked incentives from the CRO scorecard. Without that, items 2 to 4 will keep recurring because nobody owns escalation.

Design principles

• A pyramid, not a list. A short set of board-level appetite statements (perhaps eight to twelve) expressed as both qualitative boundaries and hard quantitative limits, then management-level limits beneath them, then early-warning triggers beneath those. Every limit must trace up to a board statement.
• One definition per metric. Each metric needs a precise definition, data source, owner, measurement frequency, escalation trigger and a named escalation path. Ambiguity in definition is how a 25% limit survives at 27%.
• Calibration against the plan, not the run-rate. The property limit was set so tightly that ordinary business growth breached it. Limits should be calibrated with headroom over the approved business plan and validated against stressed conditions, so that a breach means something has gone wrong rather than something has gone right.
• Frequency matched to volatility. Any metric that can move materially inside a quarter must be reported monthly or better, with a defined out-of-cycle escalation.
• Linkage. Each appetite statement should connect to the capital plan, the funding plan and the recovery plan, so the board can see the consequence of a breach rather than just the number.

Tests of effectiveness

1. Would the board have known within one reporting cycle that the property exposure was heading for 27% before it breached?
2. Can each board statement be traced down to a limit and across to a capital or liquidity consequence?
3. Do breaches change behaviour, or only produce log entries?
4. Can a director explain the top three risks and the bank's tolerance for them without reading the pack?

Concede the efficiency point, reject the conclusion.

There is real value in the risk function being close to finance: shared data, shared forecasting, faster reconciliation of exposures to the general ledger. Co-location and shared systems should be encouraged.

But the reporting line is a different question from proximity. Finance is accountable for optimising the balance sheet, hitting the earnings plan and pricing the capital raise. Risk is accountable for independently challenging whether the risk taken to achieve those outcomes is within appetite. When the same executive owns both, the challenge function is being asked to grade its own homework, and the prudential expectation of an independent CRO with direct board access is not met.

Then make the argument concrete with the bank's own evidence. In nine months, three breaches of the same limit were closed by management without a board-level root-cause review. That is what an escalation channel looks like when it runs through the executive who owns the exposure.

Offer a workable compromise: CRO reports to the CEO, attends executive committee, meets the board risk committee in private session at every meeting, and cannot be removed or have remuneration materially changed without board approval. Finance keeps joint ownership of data and forecasting; risk keeps the independent opinion. This preserves the efficiency the CEO values while fixing the independence defect - and it is the version of the model a Tier 2 investor or a prudential supervisor will expect to see.