How to Hire a CRO: A Complete Guide for UK Companies

In this guide, CRO means Chief Risk Officer: the senior executive responsible for the firm’s risk management framework — the policies, processes and people that identify, assess, monitor and respond to the risks that could derail the business. The role is most established in financial services, where it carries a regulatory footprint under the Senior Managers and Certification Regime (SM&CR), but it has spread well beyond regulated sectors as boards have become more attentive to risk after corporate failures, cyber incidents, third-party disruption and enforcement action across the UK economy. The Chief Risk Officer’s job is to make the firm’s risks visible, to provide independent challenge to the executive team where risk and return need to be weighed, and to give the board assurance that the firm’s actual risk profile matches its stated risk appetite.

Looking for a Chief Revenue Officer instead? That is a commercial, sales-led role and a very different hire — see our Chief Revenue Officer page.

This guide is written for chairs, CEOs, audit and risk committee chairs and boards working through Chief Risk Officer succession at UK firms. It sets out what the appointment actually involves: when a firm needs a CRO rather than relying on the CFO or COO for risk oversight, what the role covers, what the candidate pool looks like, how the search should run, how to structure the package for a second-line role, and what the first hundred days look like. It covers the corporate (non-regulated) Chief Risk Officer appointment in depth, and sets out the regulatory position for banks, insurers and FCA Enhanced firms where the CRO holds the SMF4 Chief Risk function. If you are ready to start a search, our Chief Risk Officer recruitment team can talk through the brief with you.

When does a firm need a CRO (Chief Risk Officer)?

Not every firm needs a Chief Risk Officer. Many UK businesses run effective risk management through a combination of the CFO, the COO and a Head of Risk reporting in below the executive team — and the decision to create a dedicated CRO seat at executive level should be deliberate rather than aspirational. Five triggers typically signal the move is warranted.

Regulatory accountability. Banks, building societies, PRA-designated investment firms and insurers are expected to have a Chief Risk function, and FCA solo-regulated firms in the Enhanced category of SM&CR are also in scope for SMF4. For these firms the question is not whether to have a CRO but how to find the right one. Firms in other regulated or heavily scrutinised sectors — healthcare, energy, utilities, and listed companies working to the UK Corporate Governance Code’s expectations on risk management and internal control — face governance pressures that often make a dedicated CRO the right answer.

Scale and complexity. Multi-jurisdiction operations, complex product or service portfolios, material counterparty or credit exposure, and a growing regulatory or compliance burden. At this scale the risk function needs strategic leadership for the same reasons the finance and operations functions do: risk decisions become too consequential to be managed departmentally.

Recent risk incidents or failures. Firms that have experienced significant operational losses, financial control failures, customer harm events, regulatory enforcement or major third-party failures usually need to show strengthened risk leadership to boards, auditors, regulators and, where relevant, shareholders. A new Chief Risk Officer appointment is often part of the rebuild.

Strategic transition. Acquisition activity at scale, international expansion into higher-risk jurisdictions, business model changes that introduce new categories of risk, and capital structure changes that alter the firm’s risk profile. These transitions often warrant a CRO as part of an executive team refresh.

Investor or capital structure changes. Private equity investment, IPO preparation, a larger debt facility or a lender review. Investors and lenders increasingly expect to see senior risk leadership in the management team, particularly in leveraged structures or sectors with material risk exposure.

Where none of these triggers applies, a Head of Risk reporting to the CFO or COO may be the better answer. Firms that appoint a CRO without the underlying need often find the role under-defined, and the appointment fails to deliver the value that justified it. A useful test is to draft the role profile before deciding: if you cannot write a credible Chief Risk Officer job description with a genuine executive remit, the firm probably needs a strong Head of Risk first.

What a CRO actually does

The substantive work of the Chief Risk Officer splits into four areas, with the balance varying by firm size, sector and risk profile.

The risk management framework. The CRO sets and maintains the firm’s risk management framework — the policies, processes, risk taxonomy, risk appetite statement, escalation routes and the governance structure that supports them. This is the foundation. A CRO who offers strategic insight but cannot keep the framework working is in a weaker position than one who can.

Independent challenge and second-line oversight. The CRO leads the second line of defence — the independent risk function that monitors first-line activity, challenges executive decisions where the risk implications need weighing, and gives independent assurance to the audit or risk committee and the board. Independence matters a great deal. CROs who get too close to the executive team lose the ability to challenge; CROs who sit too far away lose sight of the decisions that matter.

Risk reporting and stakeholder relationships. The CRO reports to the risk committee or audit committee, the board, the executive team and, in regulated firms, the regulator. Strong CROs build genuine working relationships with the committee chair, the external auditors, the head of internal audit and any external risk advisers, and use those relationships to give the board the picture it needs without being captured by any single perspective.

Executive contribution. CROs usually sit on the executive committee and contribute to decisions beyond the immediate risk remit — strategy, M&A diligence, capital allocation, organisational design, talent and culture. Strong CROs are partners to the CEO and CFO on these questions while keeping the independence the role requires. Weaker CROs are either confined to a risk silo or absorbed into executive thinking in ways that compromise their second-line role.

The balance varies considerably. Financial services CROs emphasise market, credit, liquidity, operational, conduct and prudential risk, with the regulatory dimension running through everything. Industrial and energy CROs emphasise operational, safety, environmental, third-party and regulatory risk. Listed-company CROs typically focus on enterprise risk management, strategic risk, fraud and financial control, alongside operational and reputational risk. Increasingly, technology and cyber risk, third-party and supply chain dependency, and operational resilience sit on every CRO’s agenda regardless of sector. A specification that matches the role weighting to the firm’s actual risk profile attracts better candidates than a generic one.

The Chief Risk Officer at regulated firms: SMF4 and the SM&CR reforms

Where the firm is regulated, the Chief Risk Officer appointment sits inside SM&CR. The Chief Risk function is designated SMF4. It applies to PRA-regulated banks, building societies, designated investment firms and insurers, and to FCA solo-regulated firms in the Enhanced category. At a dual-regulated firm, SMF4 is a PRA-designated function and the application is assessed by the PRA with FCA consent; at an Enhanced solo-regulated firm it is an FCA function. Either way, the individual needs regulatory approval before taking up the role, holds a Statement of Responsibilities, and carries personal accountability under the Duty of Responsibility.

The regime has been changing. The FCA’s PS26/6 and the PRA’s PS12/26 finalised the first phase of SM&CR reforms, with most changes taking effect on 24 April 2026. Three are directly relevant to CRO hiring:

• The 12-week rule has changed. Where an SMF holder leaves unexpectedly, the firm now has 12 weeks to submit a complete application for the replacement, rather than to have it approved. The person providing temporary cover can stay in place while the regulator decides, and Senior Manager Conduct Rules apply to them. The regulators then have up to three months to determine a complete application.
• Regulatory references are faster. FCA guidance now expects firms to respond to reference requests within four weeks rather than six, which helps the referencing stage of a CRO appointment move more quickly.
• Criminal record checks have a longer window. Under the PRA changes, the check must fall within six months before submission, up from three, which reduces the risk of a check expiring during a long process.

A second phase is now out for consultation. The PRA’s CP14/26, published on 22 October 2026 and open until 22 January 2027, proposes moving a number of senior manager roles from pre-approval to notification — including the Chair of the Risk Committee (SMF10) and Head of Internal Audit (SMF5). SMF4 is not among them: the Chief Risk function is proposed to remain subject to pre-approval, alongside the CEO, CFO and Chair. These are proposals, not final rules, and the regulators have said they intend to finalise them in 2027. For CRO hiring the practical point is simple: boards should continue to plan for a full approval process, with the candidate’s fitness and propriety evidence, regulatory references and interview preparation built into the search timeline from the start.

Operational resilience is the other regulatory area that has reshaped the role. Under the FCA’s operational resilience rules, in-scope firms had to be able to remain within impact tolerances for their important business services in severe but plausible scenarios by 31 March 2025. Mapping, scenario testing and third-party dependency now sit squarely in many CROs’ remit, and candidates who have led that work are in demand. For the regulated appointment in more depth, see our SMF4 Chief Risk Officer hiring guide, and for banks specifically our guide to CRO recruitment at challenger banks and dual-regulated firms.

The CRO candidate pool

The senior end of the UK Chief Risk Officer market is tight. Risk functions were built out across financial services after the financial crisis, and demand has since spread to non-regulated firms, but the number of people who have genuinely run a second-line function at executive level remains small. Five pools recur across the searches we run.

Sitting CROs at peer firms. The most common pool — candidates who currently hold the CRO seat at a firm of similar size, sector and risk profile. They have shown they can do the job and bring direct sector experience. The challenge is that the population is small and the most credible people are rarely looking. Discreet, direct approach is the standard method.

Heads of Risk and Deputy CROs at larger firms. The natural step-up pool. Candidates in senior risk roles below CRO level — Head of Risk, Deputy CRO, Head of Credit Risk or Head of Operational Risk, depending on the firm — at a substantially bigger business, who are ready for the top seat at a smaller one. They bring depth from a more demanding environment, with the trade-off that this is their first executive committee role.

Big Four and consulting firm transitions. Senior risk advisory partners and directors moving in-house. This pool brings strong technical foundations and broad sector exposure. The question to test is whether the candidate has made a real transition from advising to operating, or would be taking on line leadership for the first time.

Internal audit and assurance leaders. A cross-discipline pool of candidates with substantial internal audit experience who have moved into risk leadership. They bring the assurance and challenge mindset naturally and often handle the committee relationship well. The question is whether they have the operational risk depth the firm needs.

Industry-specialist CROs from related sectors. Where the firm operates in a sector with particular risk dynamics — financial services, healthcare, energy, utilities, insurance — candidates who have run risk functions in adjacent sectors bring relevant breadth. For regulated firms, prior SMF4 approval at another firm is the strongest single credential, because the candidate has already been through a regulatory fitness and propriety assessment for the role.

One pool note. Candidates who have moved between first-line and second-line roles can bring real operational understanding to the Chief Risk Officer seat, but regulators assessing an SMF4 application will probe independence carefully where the most recent senior role was first-line. In non-regulated firms the same question matters; it is simply tested through referencing and interview rather than regulatory review.

The search process

A well-run Chief Risk Officer search has six phases. The durations below are a guide from practice rather than a promise — the real timeline depends on the market for the specific profile, how quickly the board can convene for interviews, and the preferred candidate’s notice period. For regulated firms requiring SMF4 approval, the regulatory stage sits on top, and the regulators have up to three months to determine a complete application.

The brief. The board, the CEO, the risk or audit committee chair and the search firm align on the role specification, the candidate pool, the package and the timeline. CRO specifications benefit from being explicit about which risk disciplines matter most — operational risk, credit and counterparty risk, regulatory and conduct risk, strategic and enterprise risk, technology and cyber risk — rather than presenting a generic risk role. Agreeing at this point who the CRO reports to, and whether they have direct access to the committee chair, avoids the brief shifting later.

Market mapping and candidate identification. Structured mapping across the relevant pools, named candidate identification and discreet first approaches. For a senior CRO this is almost entirely a direct-approach exercise; advertising adds little at this level.

Shortlist development. The strongest candidates from the mapping are engaged formally and taken through structured assessment. A CRO shortlist typically runs to four to six people, balanced across the pools rather than drawn from one.

Interviews and assessment. The shortlist meets the CEO, the committee chair, the wider executive committee, the chair and, where relevant, major shareholders. CRO assessment combines technical depth — framework knowledge and expertise in the specific risk disciplines — with executive leadership capability and the independence test.

Selection and offer. The preferred candidate is offered the role, terms are negotiated and the candidate accepts. Offers built only on internal precedent often miss where the senior risk market actually is, so it is worth testing the package against the market before the offer, not after a refusal.

Onboarding and handover. The new CRO works through their notice while the firm prepares the committee introduction, the second-line team introduction and the first hundred days plan. For regulated appointments, the regulatory application, Statement of Responsibilities and any interview preparation run in parallel with this stage.

Assessment: how to evaluate CRO candidates

Chief Risk Officer assessment combines technical risk evaluation with executive leadership evaluation and a specific test of independence. Three dimensions deserve particular attention.

Technical risk depth. Strong candidates can show real depth in the disciplines relevant to the firm — market and credit risk in financial services, operational and third-party risk in industrial and technology firms, conduct risk in consumer-facing regulated firms. Case-style discussion of specific scenarios — how the candidate would think about a particular exposure, how they handled past incidents, how they would shape the risk appetite framework — draws this out far better than generic competency interviews.

Independence and challenge. The CRO’s job includes challenging the executive team. Candidates with a track record of effective challenge — escalating uncomfortable findings, pushing back where risk was under-weighted, working constructively with the committee through difficult conversations — bring evidence of independence. References from former CEOs, committee chairs and heads of internal audit are the most reliable source. Candidates who come across as accommodating at interview are sometimes candidates who have never been tested at the moments when independence matters.

Executive contribution. The CRO has to operate at executive level while preserving second-line independence. This is subtler than for most C-suite roles — too close and the challenge goes, too distant and the visibility goes. Good assessment processes ask the candidate directly how they manage that balance and test the answer in referencing.

One assessment trap recurs: confusing risk process expertise with risk leadership. Candidates who can describe frameworks and methodologies fluently are not the same as candidates who have led a risk function through difficult moments — major losses, enforcement, board disagreements about risk appetite, third-party failures. The process should test the leadership dimension explicitly, through case discussion and through references that ask what the candidate actually did when things went wrong.

For regulated firms there is a fourth dimension: whether the candidate will pass a fitness and propriety assessment for SMF4 and present well if the regulator interviews them. That means checking regulatory history, references and any previous SMF approvals early, rather than discovering an issue after the offer.

Compensation: what drives the package

Chief Risk Officer packages have the standard four components — base salary, annual bonus, long-term incentives and benefits — but the level and structure vary widely with firm size, sector, ownership and regulatory status. Rather than relying on generic salary tables, boards get better outcomes by understanding the factors that move the package and testing the specific brief against the live market.

Scope and complexity. The breadth of risk disciplines the CRO owns, the size of the second-line team, the number of jurisdictions and the complexity of the balance sheet all push the package up. A CRO overseeing credit, market, liquidity and operational risk at a bank is a different market from a CRO running enterprise risk at a mid-sized services group.

Regulatory accountability. Holding SMF4 means personal accountability under SM&CR, and candidates price that in. Regulated-firm CROs generally command more than peers in non-regulated businesses of similar size, and prior SMF4 approval is a premium credential.

Ownership and listing status. Listed companies set packages within a shareholder-approved remuneration policy and disclosure requirements. Private equity-backed businesses usually offer a lower base with a meaningful equity element. Owner-managed businesses vary widely and often need to compete on role scope and influence as much as on pay.

Bonus metrics that fit a second-line role. CRO bonuses should not be linked to revenue or commercial performance — the role is structurally independent of the business, and tying pay to commercial outcomes compromises that independence. Good structures use measures such as risk framework effectiveness, quality of regulatory engagement, audit findings, independent assessments of the second line and stakeholder feedback. Boards that skip this can create perverse incentives without intending to.

Regulatory remuneration rules. In financial services, the FCA and PRA remuneration codes apply to relevant firms and shape the structure of CRO pay — deferral, malus and clawback, and how performance measures are designed. Non-regulated firms are not bound by those codes, but committees increasingly expect risk leadership pay to follow the same principles.

Market tightness. Packages benchmarked against historical internal precedent, or against a Head of Risk one level down, are the most common reason strong candidates decline at offer stage. The answer is to test the envelope against the market during the brief.

Common CRO search pitfalls

Six patterns recur in Chief Risk Officer searches that go off track.

Briefing a Head of Risk rather than a CRO. The most common failure. Specifications that emphasise operational risk delivery and team management, without the strategic, second-line and executive dimensions, attract candidates whose seniority does not match the firm’s needs. The fix is to specify the executive contribution and the independence dimension explicitly.

Package anchored on internal precedent. Boards benchmarking against historical internal pay or against Head of Risk packages often produce offers the strongest candidates turn down.

Bonus structures that compromise independence. CROs whose pay is linked to commercial outcomes face incentives that reduce the role’s effectiveness. Strong committees interrogate the bonus structure during the appointment; weaker oversight allows designs that look reasonable on paper but undermine the role.

Underspecifying the committee relationship. The CRO works closely with the chair of the risk or audit committee. Specifications that ignore that relationship miss something strong candidates probe carefully. The best searches involve the committee chair throughout, including direct conversations with shortlisted candidates.

Pattern-matching to the previous CRO. Looking for someone who resembles the predecessor — same background, sector and career path — is rarely right, because the firm’s risk profile has usually moved on. Specify what the firm needs from the next CRO given its current risks and direction.

Underestimating the approval stage at regulated firms. SMF4 appointments need regulatory approval, and the regulators have up to three months to decide a complete application — longer if it is incomplete. Boards that leave this out of the plan risk a gap in the role or pressure to compromise on the strongest candidate. The 12-week rule now gives more room for temporary cover, but it is not a substitute for planning.

The first hundred days

The first hundred days of a new Chief Risk Officer’s tenure are where the work done before the appointment either pays off or does not. Three things usually decide the outcome.

The key relationships. The CRO’s most important working relationships are with the CEO, the committee chair and the CFO. Strong onboarding includes structured time with each before the formal start date, covering their view of the risk environment, how they want to work together, and any matters from the previous CRO’s tenure the new CRO needs to understand.

The risk function review. The new CRO inherits the existing second-line team and must decide fairly quickly who will lead the next phase, who needs development and where there are gaps. This assessment usually happens through one-to-ones, observing risk committee meetings and reviewing recent risk reporting.

The first risk profile review. Most new CROs have to work out where the firm’s actual risk profile sits compared with what has been reported. Good onboarding gives them the time and information to do this properly rather than reactively, including early conversations with the external auditors and, where relevant, the regulator.

For regulated firms, the hundred-day plan should also cover the Statement of Responsibilities and the firm’s management responsibilities map. A new SMF4 holder will want to be confident that what they are accountable for on paper matches what they can actually control, and that any handover from the predecessor is documented.

Interim and fractional Chief Risk Officer options

Not every risk leadership need is a permanent hire. An interim Chief Risk Officer is often the right answer when the incumbent leaves at short notice, when a firm is rebuilding its risk function after an incident, or when a regulated firm needs experienced cover while the permanent search and approval run. At regulated firms, the revised 12-week rule makes this more workable, because the person providing temporary cover can remain in place while the regulator considers the permanent candidate’s application — although the arrangement still has to fit the rules on temporary cover, and the interim is subject to the Senior Manager Conduct Rules while acting.

Smaller and growing businesses that need senior risk judgement but not a full-time seat can use a fractional arrangement as part of a wider fractional C-suite: a senior risk leader working a set number of days a month to build the framework, set risk appetite with the board and develop a Head of Risk. That works well before a firm reaches the point where a full-time CRO is justified. It is generally not suitable where the firm needs an approved SMF4 holder on a full-time basis, where the regulator will expect the Chief Risk function to have sufficient time and resource.

How Exec Capital approaches CRO mandates

Exec Capital runs Chief Risk Officer searches as combined risk and executive leadership work. The technical risk dimension — second-line capability, depth in the relevant disciplines, framework expertise and the committee relationship — gets the same rigour as any senior C-suite search, with the executive leadership and independence tests built in alongside. We work on a retained basis for CRO mandates, and the engagement runs through to the candidate’s first day in role.

Our CRO recruitment work covers SME, mid-market, private equity-backed and corporate businesses across financial services, professional services, industrial and energy, healthcare and technology. Where the appointment is into a regulated firm and the CRO will hold SMF4, we layer the regulatory requirements over the commercial brief: fitness and propriety checks, regulatory references and the timing of the approval stage are built into the plan from day one.

For boards beginning CRO succession, weighing whether existing risk leadership should be elevated, or making a CRO appointment as part of a wider executive team refresh, we offer an initial conversation that covers the role specification, the candidate pool and a realistic timeline before any formal mandate begins. Every search is run by our specialist team, with Adrian Lawrence FCA overseeing each mandate.

Further reading

For how the Chief Risk Officer is positioned at board level in regulated firms, see our guide to board-level CRO governance and SMF4 approval, and for why independence defines the role, our explainer on SMF4 and the Chief Risk function. Because the CRO and CFO work so closely together, boards hiring both should also read our How to Hire a CFO guide.

For listed companies, the UK Corporate Governance Code sets out board expectations on risk management and internal control, including the Provision 29 declaration on the effectiveness of material controls, which applies to financial years beginning on or after 1 January 2026. The Institute of Risk Management and the Chartered Institute of Internal Auditors also publish guidance on risk leadership, risk culture and the relationship between the second and third lines.

Frequently asked questions

What does CRO stand for on this page?

Chief Risk Officer — the executive who leads the firm’s risk management framework and second line of defence. CRO can also mean Chief Revenue Officer, a commercial role covered separately on our site.

Does every regulated firm need an SMF4 Chief Risk Officer?

No. SMF4 applies to PRA-regulated firms such as banks and insurers, and to FCA solo-regulated firms in the Enhanced category. Core and Limited Scope firms are not required to have an SMF4, although many still appoint a senior risk lead.

Will SMF4 stop needing regulatory pre-approval?

Not under current proposals. The PRA’s CP14/26 proposes moving several senior manager roles to notification, but the Chief Risk function is proposed to remain pre-approved. The consultation closes on 22 January 2027 and the rules are not yet final.

How long does the regulatory approval take?

The regulators have up to three months to determine a complete application, and longer if it is incomplete. A well-prepared application with references and checks in order is the best way to avoid delay.

Should the CRO report to the CEO or the board?

Usually both: a line to the CEO for day-to-day management and direct, unrestricted access to the chair of the risk or audit committee. That dual line is what protects the CRO’s independence.

Can an interim cover the CRO role during a search?

Yes. Interim cover is common, and at regulated firms the revised 12-week rule lets the person covering stay in place while the regulator considers the permanent appointment, provided the application is submitted within 12 weeks.