The CRO Who Reports to the CFO: Governance Failures at an Islamic Bank
A mid-sized Islamic bank in Karachi (assets PKR 310bn) has a board risk committee that met three times last year. Its chair is a former corporate banker who also chairs the audit committee and sits on the board of the bank's largest murabaha client. The CRO, in post 14 months, reports to the CFO; the CEO chairs the management credit committee and can override her limit recommendations. In Q3 the treasury desk breached its 12-month profit-rate gap limit for nine consecutive days. The breach reached the risk committee six weeks later and was logged as 'technical'. Internal audit, which also reports to the CFO, raised no finding. The SBP inspection letter cites 'weak risk culture and blurred accountability'. The chairman proposes a one-page fix: make the CRO report to the board, add two independent directors to the risk committee, and close the matter.
1. Using the three lines of defence model, identify the governance failures and rank them by severity.
Read the worked answer
First line: treasury ran a nine-day gap breach with no evidence of pre-agreed remediation or escalation, which means the desk did not treat the limit as binding.
Second line: the CRO reports to the CFO, who is measured on earnings and capital outcomes; the CEO can override limits and also chairs the credit committee. Independence is structurally absent, so the CRO cannot challenge the first line.
Third line: internal audit reports to the same CFO and found nothing on a breach that was known internally. That is a failure of assurance, not just of reporting lines.
Board: the risk committee meets three times a year (too infrequent for a PKR 310bn balance sheet), its chair is conflicted through a client directorship and through dual audit/risk chairing, and 'technical' was applied after the event rather than against ex-ante criteria.
Ranking by severity: (1) CRO authority and override power, because without it every other control is optional; (2) audit independence, because undetected breaches compound silently; (3) conflicted risk committee chair, because it corrupts the escalation endpoint; (4) escalation lag and retrospective relabelling, which is a symptom of 1-3; (5) meeting cadence and skill mix. Fixing cadence first would be cosmetic - the exam-relevant point is that severity follows from whether a control can operate at all, not from how visible the defect is.
2. Evaluate the chairman's proposal. What would you add, and in what sequence?
Read the worked answer
Making the CRO report to the board risk committee is necessary but not sufficient. A reporting line does not confer authority: the CEO can still override recommendations unless the board approves a risk appetite statement, a delegated authority matrix and a documented CRO veto over limit exceptions and new-product approvals. Similarly, adding two independent directors helps only if the committee has a majority of independents, an independent chair, and a charter requiring at least quarterly meetings plus ad hoc access to the CRO.
Add: (1) removal of the CEO from the credit committee chair, or at minimum a non-executive chair and recorded dissent; (2) internal audit reporting to the audit committee, with a direct line to its chair; (3) a breach policy defining 'technical' ex ante (e.g., system-driven, no P&L impact, corrected within 24 hours) and requiring escalation within 24-48 hours; (4) a risk-adjusted scorecard so the CFO and business heads are not rewarded purely on earnings; (5) a board-approved culture and conduct programme with KRIs such as overdue limit reviews, escalation timeliness and repeat breaches.
Sequence matters. First the interim escalation protocol and independent review of the Q3 breach, then charter and committee changes, then structural reporting changes and, finally, regulatory engagement - a self-identified remediation plan presented to the SBP is stronger than waiting for the next inspection.
3. The risk committee chair objects that removing him would breach his appointment letter and slow decision-making. How should the board handle the conflict, and how should the nine-day gap breach be treated?
Read the worked answer
The appointment letter is a legal question, not a risk question: the board should obtain counsel on whether the dual role and the client directorship were disclosed and permitted. In the interim, the conflict is managed, not debated - he recuses himself from all matters touching the murabaha client and from any decision on the breach, and an independent director chairs those items. If the conflict is material and continuing, a board resolution can create a temporary alternate chair without terminating the appointment, which removes the 'slowness' objection.
The nine-day gap breach should be presumed genuine. 'Technical' is only defensible if the bank's policy defined the term before the event and the facts fit: no economic exposure, caused by a data or system error, corrected within a set window, no repeat. Nine consecutive days suggests a deliberate position or an unreconciled limit, and a six-week reporting delay is itself a breach of escalation standards. The board should require a root-cause analysis, a limit recalibration against actual balance-sheet behaviour, a review of whether the gap was funded deliberately for carry, and a decision on whether the breach is reportable to the SBP. The chair's objection should not delay any of this; it should be minuted.