The Board-Level CRO: Governance Positioning and SMF4 Approval Considerations

The Chief Risk Officer at a regulated financial services firm occupies a governance position that is structurally different from every other member of the executive leadership team. Every other C-suite executive — the CEO, CFO, COO, CMO — is accountable for delivering commercial outcomes within the firm’s risk appetite. The CRO is accountable for defining what that appetite is, for making sure the firm understands and manages its exposure relative to it, and for providing independent challenge when business decisions carry risk that the organisation is inadequately assessing or mispricing. At firms where the Chief Risk function is a designated Senior Management Function, this independence is not a governance preference. It is what the regulators expect to see, and what they will test when the individual is put forward for approval.

The governance positioning of the CRO — how the role is structured relative to the CEO, the board and the Risk Committee — determines whether that independence is real or nominal. A CRO who reports solely to the CEO, whose budget is controlled by the business lines they oversee, and who attends the Risk Committee only by invitation is not structurally positioned to provide independent oversight, regardless of their personal capability. Getting the governance positioning right before making the appointment is as important as getting the appointment itself right.

Whether you are running the process yourself or with a specialist CRO recruitment partner, the structural questions need answering first. This guide is written for chairs, Risk Committee chairs, CEOs and nominations committees preparing to appoint a Chief Risk Officer. It covers what the SMF4 designation adds to the role, how the reporting line to the Risk Committee chair should work in practice, what the approval process involves and how long it realistically takes, what changed when the first phase of the Senior Managers and Certification Regime (SM&CR) reforms took effect on 24 April 2026, what the October 2026 consultations mean for SMF4, and how firms should handle interim cover and smaller-firm role combinations. If you are earlier in the process and still defining the role, our Chief Risk Officer job description sets out the typical scope and candidate profile.

The SMF4 Designation: What It Adds to the CRO Role

SMF4 is the Chief Risk function under the Senior Managers Regime. Where it applies, the individual must be approved by the regulator before they begin performing the function, they are subject to the Duty of Responsibility for failures within their area of accountability, and they must hold a Statement of Responsibilities that accurately describes their specific risk oversight obligations. The application is made on Form A through the regulators’ Connect system, supported by the firm’s own fitness and propriety assessment of the candidate.

Which regulator approves the appointment depends on the firm. At banks, building societies, PRA-designated investment firms and insurers, SMF4 is a PRA-designated function: the Prudential Regulation Authority leads the assessment, and the FCA must give its consent before a final decision is made. At FCA solo-regulated firms, SMF4 applies only to Enhanced SM&CR firms. Core and Limited Scope firms do not have an SMF4 at all, although many still appoint a Head of Risk or Chief Risk Officer as a senior executive role outside the Senior Managers Regime.

The SMF4 designation therefore does not automatically attach to every CRO-equivalent role at every firm. Some firms have a Head of Risk or Group Risk Director who performs the risk oversight function but is not designated as SMF4 — typically because the firm is not in scope for the function, or because the individual sits below a group CRO who holds the designation. Boards should confirm with their compliance function which designation applies to the risk oversight function at their firm before opening the appointment process, because the regulatory requirements and the approval process differ significantly between the two. Our overview of what the Senior Managers Regime means when recruiting at board level explains how the SMF framework affects every senior appointment, not just the CRO.

Where the SMF4 designation applies, the CRO is a personally accountable senior manager in the full regulatory sense — not simply a senior executive with risk oversight responsibilities. The personal accountability dimension changes what the role requires of the individual and what the appointment process needs to assess. A candidate who has held a risk role without a designation may be technically excellent, but they have not yet carried personal regulatory accountability for the function, and the board should explore how they think about that before committing to them.

Governance Positioning: The CRO’s Reporting Line and Authority

The regulators expect the Chief Risk Officer to have a reporting line that protects their independence from the business lines they oversee. At most regulated firms this means the CRO has a primary reporting line to the CEO, to keep the risk function integrated with how the business actually runs, and a direct line to the board through the chair of the Risk Committee, to keep the risk function independent. The second line is the structural mechanism by which the board maintains oversight of the risk function without relying on the CEO’s filter.

The regulators pay attention to whether this second reporting line is genuine or merely documentary. A CRO who attends Risk Committee meetings but whose written reports to the committee are reviewed and edited by the CEO before submission, whose access to the committee chair is mediated through the CEO’s office, or who cannot escalate a material risk concern directly to the board without the CEO’s knowledge and consent, does not have a genuine independent reporting line, whatever the governance documents say.

Independence also has practical markers that boards can check before the appointment is made. The most useful are:

• Appointment and removal. The Risk Committee, or the board on its recommendation, should have a decisive say in appointing and removing the CRO. A CRO who can be removed by the CEO alone is exposed to exactly the commercial pressure the role is meant to resist.
• Objectives and remuneration. The Risk Committee chair should have input into the CRO’s objectives and performance assessment, and the CRO’s variable pay should not depend on the revenue of the business lines they challenge.
• Budget and resourcing. The risk function’s budget should be agreed with the Risk Committee rather than set solely by the executive, so that resourcing cannot quietly be used to limit oversight.
• Information rights. The CRO should have unrestricted access to management information, committee papers and staff across the firm, including subsidiaries and outsourced functions.

The board’s role is to actively maintain the CRO’s independence by making sure the direct line to the board is structured and used in a way that gives the CRO genuine access, genuine authority to challenge business decisions, and genuine protection from commercial pressure. This requires the Risk Committee chair (SMF10) to take an active role in managing the CRO relationship — meeting privately with the CRO before formal Risk Committee meetings, making sure the CRO’s assessment of the firm’s risk position is heard independently of management’s presentation, and being willing to raise concerns about the CRO’s independence directly with the chair and CEO where necessary.

The CRO’s Relationship with the Risk Committee

The Risk Committee is the primary governance body through which the board maintains oversight of the firm’s risk management. The CRO’s relationship with the Risk Committee chair is one of the most important governance relationships in a regulated firm, and its quality directly affects the board’s ability to perform its oversight function. A Risk Committee chair who does not engage with the CRO between meetings — who receives the CRO’s formal committee report without prior discussion, without context, and without the informal briefings that allow genuine engagement with the issues — is not performing the oversight function the board requires.

Good practice for the CRO and Risk Committee chair relationship includes:

• regular one-to-one meetings between the CRO and the SMF10 chair outside the formal committee cycle;
• the CRO’s involvement in setting the committee’s agenda, including the right to raise matters for the committee’s attention without the CEO’s prior approval;
• private sessions at Risk Committee meetings where the CRO can discuss the risk environment with non-executive directors without management present;
• an agreed escalation protocol for material risk events that gives the CRO a direct path to the committee chair when immediate governance attention is required.

The relationship works in both directions. A CRO appointment is also a test of the Risk Committee chair, because a new CRO will quickly find out whether the chair will back them when their challenge is unwelcome. Where the firm is recruiting both roles, or where the Risk Committee chair is new, it is worth sequencing the appointments so that the chair is in place first and can take part in the CRO selection. Our SMF10 Chair of Risk Committee hiring guide covers that appointment in detail.

Boards should also be aware that the SMF10 role itself may change status. Under the second phase of SM&CR reform proposals published in October 2026, both regulators proposed moving the chair of the Risk Committee from pre-approval to a notification-only regime. That would make the SMF10 appointment quicker, but it would not reduce the chair’s responsibility for overseeing the risk function or for protecting the CRO’s independence.

The SMF4 Approval Process and Realistic Timings

Once the board has chosen its candidate, the approval process follows a predictable sequence. The firm completes its own fitness and propriety assessment, obtains regulatory references from the candidate’s previous employers in regulated roles, carries out a criminal records check, prepares the Statement of Responsibilities and updates the Management Responsibilities Map where the firm is required to keep one. Form A is then submitted through Connect, with the Statement of Responsibilities attached.

The regulators have a statutory period in which to determine a complete application. The PRA describes this as a statutory obligation to complete its review of the application in 90 days from receipt, and notes that the clock stops when it needs further information or an interview. In practice, the most common causes of delay are an incomplete application, a regulatory reference that arrives late or raises questions, undisclosed information that comes to light during checks, and a Statement of Responsibilities that does not match the role the regulator understands the candidate to be taking. The PRA’s guidance on Senior Managers Regime approvals also warns that a firm which does not respond to an information request within four weeks may be treated as a non-responder and the application rejected.

Boards should therefore plan the CRO appointment as three overlapping workstreams rather than one: the search itself, the candidate’s notice period, and the approval. A senior CRO moving from another regulated firm will often have a notice period of several months, and the approval can usually run in parallel with it if the firm prepares the application promptly. Where the firm needs the CRO in post by a particular date, it should state the intended effective date in the application; the PRA says it will make every reasonable effort to meet it but cannot guarantee to do so. Our article on how long FCA SMF approval actually takes sets out a realistic timeline for boards.

The preparation the firm controls makes the biggest difference. Applications that move quickly tend to share the same features: references requested as soon as the preferred candidate is identified, a Statement of Responsibilities drafted with the candidate rather than handed to them, a clear explanation of how the CRO’s reporting lines work, and a candidate who has been briefed on the firm’s risk profile before any interview.

SMF4 Approval: What the FCA Assesses

The regulators’ assessment of an SMF4 applicant focuses on the individual’s understanding of the risk management obligations of the role and their capability to exercise genuine independence in a commercial environment that may create pressure to minimise risk concerns. For dual-regulated firms the PRA leads, with FCA consent; for Enhanced solo-regulated firms the FCA assesses alone. Interviews are most likely for the most senior roles at the largest firms, but either regulator may interview at its discretion, and where both want to interview they will normally seek a single joint interview.

The regulatory interview typically explores:

• the candidate’s understanding of the firm’s specific risk profile, including its principal risks, risk appetite and capital or liquidity position;
• their approach to managing the tension between risk oversight and commercial relationships;
• their experience of situations where they provided challenge that was unwelcome but necessary, and what happened as a result;
• their understanding of the personal regulatory accountability the SMF4 designation carries, including the Duty of Responsibility and the Senior Manager Conduct Rules;
• how they would assess the risk function they are inheriting in their first months, and what they would change.

A CRO candidate who cannot describe a specific situation in which they provided material challenge to a business decision — whose risk oversight track record is characterised by agreement with business line conclusions rather than independent assessment — will leave a regulatory interview with a poor impression that affects both the approval decision and the ongoing supervisory relationship. Boards should assess their preferred CRO candidate against this dimension specifically, rather than assuming that technical risk expertise and a positive professional reputation are enough to carry them through approval. Our guide on how to hire a CRO includes interview and assessment questions that test for exactly this.

What Changed Under PS26/6

The FCA’s PS26/6 policy statement on the SM&CR review confirmed the first phase of reforms, with most changes taking effect on 24 April 2026 and some further changes, including updated forms and higher Enhanced firm thresholds, from 10 July 2026. Dual-regulated firms should read it alongside the PRA’s corresponding policy statement, PS12/26. Several of the changes bear directly on a CRO appointment:

• The 12-week rule. Firms now have 12 weeks to submit an SMF application for someone covering a vacant senior manager role, rather than 12 weeks to obtain approval. This gives meaningful breathing space when a CRO leaves unexpectedly.
• Criminal records checks. A check is now treated as valid for six months rather than three, and checks are no longer needed for internal or intra-group moves — useful where a group promotes its deputy CRO or moves a CRO between regulated entities.
• Regulatory references. The FCA has cut the period for responding to a regulatory reference request from six weeks to four, which should shorten one of the most common sources of delay.
• Statements of Responsibilities and responsibilities maps. Firms no longer have to resubmit these every time something changes; significant changes can be notified within six months, with only the latest version submitted.
• Enhanced firm thresholds. Certain financial thresholds for Enhanced firms rose by 30%. Some solo-regulated firms near the boundary may have moved out of the Enhanced category, and with it out of the SMF4 requirement.

None of these changes alters the substance of what the regulators expect from a CRO. They reduce administrative friction and make it easier to manage a vacancy, but the independence of the function, the content of the Statement of Responsibilities and the fitness and propriety standard are unchanged. Firms that were in or near the Enhanced category should check their status against the revised thresholds before assuming the CRO must be an SMF4 appointment.

Phase 2 Proposals: Why SMF4 Stays Pre-Approved Under CP14/26

On 22 October 2026 the PRA published CP14/26 and the FCA published CP26/37, setting out the second phase of SM&CR reform. The PRA describes its proposals as the most significant reforms to the regime since its introduction. The headline change is that a substantial number of SMFs would move from pre-approval to notification, meaning the firm would notify the regulator rather than wait for approval before the individual takes up the role. The consultations close on 22 January 2027, with final rules expected in the first half of 2027 and implementation in the second half, subject to the necessary legislative changes.

The Chief Risk function is not among the roles proposed for notification. In the PRA’s draft updated supervisory statement published with CP14/26, SMF4 remains in the group of functions subject to PRA pre-approval with FCA consent, alongside the Chief Executive and Chief Finance functions. Several of the non-executive committee chair roles, including the chair of the Risk Committee, are proposed for notification instead.

For boards, the practical message is that the CRO appointment will continue to need regulatory approval before the individual can perform the function, so the planning discipline described above still applies. If the proposals go ahead, the balance of the board’s governance appointments will shift: the Risk Committee chair could be in post more quickly, but the CRO would remain one of the few roles where the regulator’s view of the candidate has to be secured in advance. That makes the quality of the board’s own assessment — and of the search behind it — more important, not less.

The CRO’s Statement of Responsibilities

The Statement of Responsibilities for an SMF4 holder needs particular care so that it reflects the genuine scope of the CRO’s authority and oversight, not simply the formal risk management responsibilities that appear in the job description. A CRO who is accountable for the firm’s risk appetite framework but who does not have the authority to challenge business decisions that threaten to exceed that appetite without CEO approval has an accountability that outstrips their actual authority — and a Statement of Responsibilities that describes the accountability without reflecting the authority gap creates personal regulatory risk for the individual.

Boards should review the CRO’s Statement of Responsibilities specifically against the question of whether the authority documented is consistent with the authority actually exercised. Where a gap exists, the answer is either to expand the CRO’s authority to match the documented accountability, or to revise the document so that it accurately reflects the actual scope of the CRO’s role. A Statement of Responsibilities that describes accountability beyond the individual’s real authority is not a safeguard. It is a regulatory risk for the CRO and for the firm.

Experienced CRO candidates will read the draft carefully, and many will ask to negotiate it before accepting an offer. That is a healthy sign rather than a difficulty: a candidate who signs whatever they are given is unlikely to be the independent challenger the role needs. The PS26/6 change allowing firms to notify significant changes within six months does not reduce the need to get the document right at the outset, because the version submitted with Form A is the one the regulator assesses the candidate against. Our guide to Statements of Responsibilities and what boards should consider before appointing an SMF covers drafting in more detail.

Working with Exec Capital

Exec Capital places Chief Risk Officers at regulated firms on permanent, interim and fractional terms. Our CRO recruitment work starts with the governance position rather than the candidate list: before we approach anyone we agree with the board how the reporting lines will work, what authority the CRO will hold, what the Statement of Responsibilities will cover and how the approval process will be timed.

During the search we assess candidates against the questions the regulator is likely to ask — in particular their record of independent challenge — and we help the preferred candidate and the firm prepare for the application and any interview. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate. Firms in the banking sector, where the PRA leads the approval, can read more in our guide to CRO recruitment at challenger banks and dual-regulated firms.

The CRO’s Authority to Challenge Business Decisions

One of the most consequential questions in structuring the CRO’s board-level position is the extent of their formal authority to challenge and, where necessary, block or escalate business decisions that carry risk exceeding the firm’s appetite. At firms with mature risk governance, this authority is documented in the risk governance framework and the CRO’s terms of reference: the CRO can formally object to a business decision, require it to be escalated to the Risk Committee and, in extremis, to the full board, before it is executed. This formal escalation right is what makes the CRO’s independence meaningful rather than advisory.

At challenger banks and growth-stage regulated firms, the CRO’s formal authority is often less clearly defined — not because the regulatory expectation of independence is absent, but because the governance framework is still being developed and the cultural norms around executive challenge are still being established. A CRO at a growth-stage firm who does not have a documented escalation right — whose ability to challenge a credit or underwriting decision depends on their personal relationship with the CEO rather than on a formal governance mechanism — is in a structurally weaker position than the regulatory framework intends, however strong their personal risk judgement.

Boards making a CRO appointment at an early-stage regulated firm should treat the governance positioning question as part of the appointment process — confirming that the risk governance framework is adequate before the CRO takes the role, rather than asking the incoming CRO to negotiate their own authority after they arrive. An incoming CRO who must negotiate the terms of their independence with the CEO is not starting the role from the position of strength the SMF4 designation requires.

A useful test is to ask what would happen in a specific scenario: a large, profitable transaction that the business wants to close this quarter, which the CRO believes would take the firm outside its risk appetite. If the board cannot say clearly who decides, how quickly the matter reaches the Risk Committee and what the CRO’s objection would trigger, the escalation framework needs work before the appointment is made.

Interim CRO Coverage at Regulated Firms

When a CRO vacancy arises at a regulated firm — whether through resignation, departure or performance management — the firm faces an immediate regulatory exposure. The risk function cannot be left without senior leadership for long without the FCA, and the PRA where applicable, taking notice. Since 24 April 2026, the 12-week rule gives firms 12 weeks to submit an SMF application for the person covering the role, which is more forgiving than the previous requirement to have approval within that window. It does not remove the need for cover that is genuinely capable of doing the job.

Interim CRO cover from an experienced individual who has previously held the SMF4 designation is frequently the most effective bridge, allowing the permanent search to be conducted properly without operational and regulatory pressure. Where the interim will stay beyond the 12-week period, the firm should plan for an SMF4 application for them, which an individual with prior approval and clean references is best placed to complete quickly. Our interim CRO service introduces risk executives who can step in at short notice and engage substantively with supervisors during the interim period.

Exec Capital maintains relationships with experienced risk executives who have held SMF4 designations and who can provide genuine interim CRO cover. These individuals bring the regulatory credibility and technical risk expertise to engage with the FCA or PRA during the interim period — not simply holding a designation on paper while the permanent search progresses, but providing real risk oversight while it does so. Boards that structure the CRO role properly from the outset — with clear reporting lines, documented escalation rights, a genuine line to the board, and a Risk Committee chair who actively manages the CRO relationship — create the conditions in which a strong CRO can succeed. Those that treat the CRO appointment as filling a regulatory requirement without creating the structural authority the function needs will find that even an excellent candidate cannot deliver effective risk governance against a structurally compromised mandate.

Combining the CRO Role with Compliance at Smaller Firms

Many smaller regulated firms cannot justify a full-time Chief Risk Officer and a full-time Head of Compliance, and look at combining the two. Both are second-line oversight roles, so a combined Head of Risk and Compliance is a common and generally workable structure, provided the individual has enough time and the right experience for both. Combining risk oversight with a first-line role — such as finance, operations or a revenue-generating function — is much harder to defend, because the individual ends up overseeing the risks created by their own decisions.

Whether a combination involves the SMF4 designation depends on the firm’s category. At a Core solo-regulated firm there is no SMF4, so the combined role will usually centre on the compliance oversight function (SMF16) with risk management as an executive responsibility. At an Enhanced or dual-regulated firm, one person can hold more than one SMF, but each application is assessed on its own merits and the firm must show the individual can discharge all of the responsibilities in their Statements of Responsibilities. Our article on whether one person can hold more than one SMF covers the practical limits.

For firms that are growing, a combined role is often a stage rather than an end point. Boards should agree in advance what will trigger separating the functions — a change in regulatory category, a new permission, entry into a higher-risk product line or a material increase in scale — so that the split is planned rather than forced by a supervisory conversation. A fractional CRO, working a set number of days each month alongside a full-time compliance lead, can be a sensible intermediate step where the firm needs senior risk judgement but not a full-time seat.

Frequently asked questions

Who should the Chief Risk Officer report to?

Usually the CEO for day-to-day management, with a direct and genuinely used line to the chair of the Risk Committee (SMF10). The Risk Committee should have a decisive role in appointing and removing the CRO and in setting their objectives.

Does every regulated firm need an SMF4?

No. SMF4 applies at banks, building societies, PRA-designated investment firms and insurers, and at Enhanced FCA solo-regulated firms. Core and Limited Scope firms do not have an SMF4, although they may still appoint a senior risk executive.

How long does SMF4 approval take?

The regulators have a statutory period to decide a complete application, which the PRA describes as 90 days, but the clock stops for information requests and interviews. A well-prepared application with references and a clear Statement of Responsibilities is the best way to keep it moving.

Will SMF4 move to notification under the Phase 2 reforms?

Not under the October 2026 proposals. The PRA’s CP14/26 draft keeps the Chief Risk function subject to pre-approval, while several committee chair roles, including SMF10, are proposed for notification. The consultations close on 22 January 2027.

Can an interim CRO cover the role while we recruit?

Yes. Since April 2026 the firm has 12 weeks to submit an SMF application for someone covering a vacant senior manager role. An interim who has previously held SMF4 approval is usually best placed to provide real cover and, if needed, to be approved quickly.

Can the CRO also be the Head of Compliance?

At smaller firms, often yes, because both are second-line roles. The firm must show the individual has the capacity and experience for both, and should plan when to separate the functions as it grows.