How a CRO briefs the board risk committee — and the regulator

What the committee needs from the seat#

A board risk committee report exists so that directors know what risk the institution is actually carrying and can test it against the boundary they agreed. That is the whole purpose, and it is worth stating plainly because most risk reports serve a different one: they exist to be approved. The chief risk officer’s report is written to be questioned, and the CRO board presentation that accompanies it is built to make the questions easy to ask.

The directors’ side of this table — the questions a board should be able to answer about risk — is set out in a separate piece; this one is the CRO’s side.

The paper#

The paper carries the evidence. It states the exposure against the boundary, in the measures the board agreed, and it does three things a report written for approval never does: it says where the exposure is moving and why, it names the assumptions the numbers rest on and which of them the CRO trusts least, and it records where the seat disagrees with management. A paper that could have been written by the first line is not a second-line paper, however accurate its figures.

The briefing#

The briefing is a different instrument. The paper carries the evidence; the briefing carries the judgement. It is what the CRO would want a director to remember if they remembered one thing. It is given at the committee’s altitude, in its language, and it leaves the technique in the paper where a director who wants it can find it.

• Lead with the judgement: where the institution stands against its boundary, and whether the CRO is comfortable.
• Name the thing that has changed since the last meeting, and what the seat did about it.
• Say which number in the paper deserves the least trust, before a director asks.
• State the disagreement with management, if there is one, as a disagreement — not as a nuance.
• Stop. A briefing that fills its slot has hidden its point in it.

Professional dissent#

The committee is entitled to hear dissent from the seat, and the CRO who never provides any has either a perfect institution or a silent function. Professional dissent is delivered as a stated disagreement with management — in the paper, so it is on the record, and across the table, so it is heard — without drama and without apology. The chief executive knows it is coming, because the CRO said so first; the committee hears two views and does its own work. That sequence is what keeps dissent professional rather than political.

The paper carries the evidence; the briefing carries the judgement.

The regulator as a standing discipline#

The regulator relationship is the second room, and the mistake most institutions make is to treat it as an event — the review, the letter, the meeting — rather than as a standing discipline. A supervisor who learns of a problem from the CRO before learning of it from the numbers treats the institution differently, and that trust is built between reviews rather than during them. The seat owns it: the regular contact, the candour about what the models cannot know, the early word when something is moving.

The supervisor is briefed at a different altitude from the committee. Directors need the exposure and the judgement; supervisors need the evidence and the record — the derivation, the assumption, the date, the decision. The same truth, told to each as they can use it, is the craft. A CRO who tells the committee what the regulator needs, or the regulator what the committee needs, has misjudged the room.

Where it goes wrong#

The failures are familiar. The paper is written for approval and the committee approves it. The briefing repeats the paper and the judgement never arrives. Dissent is softened into nuance and the committee hears one view. The regulator learns of the problem from the numbers, and every subsequent conversation starts from suspicion. Each is a failure of the seat rather than of the function, and each is visible in advance to a CRO who reads their own paper as a director would.

What to do before the next meeting#

Read the last paper as a director would and mark where it could have been written by the first line. Write the one sentence the briefing should leave behind. Decide, before the meeting, whether there is a disagreement with management and how it will be stated. And ask when the supervisor last heard something from the seat before hearing it from the numbers. These are the rooms The CRO Mandate is built to work, with practitioners who have sat in them.