SMF4: The Chief Risk Officer Function and Why Independence Defines It

The Chief Risk Officer is the Senior Management Function the regulator relies on to be the independent check inside a firm. SMF4 — the chief risk function — is held by the individual with responsibility for the firm’s risk management framework, and the defining feature of the role is its independence from the business it oversees. For a board appointing a CRO, that independence shapes who can hold the function, how the role is structured, and what the firm must demonstrate to the regulator. This article explains what SMF4 is, why independence matters so much, and how to run the search.

Exec Capital runs Chief Risk Officer (SMF4) mandates as retained, research-led searches led personally by the founder — assessing candidates against both risk leadership capability and the regulatory standing the function demands.

What SMF4 Is

SMF4 is the chief risk function — a Senior Management Function held by the individual with overall responsibility for the firm’s risk management framework and for overseeing the risks the firm runs. The holder owns the firm’s risk appetite framework, the identification and monitoring of its material risks, and the independent challenge of the business’s risk-taking. In most firms the holder is the Chief Risk Officer, and at larger firms the function is a mandatory one.

Like every Senior Management Function, SMF4 is held by an approved person who must be assessed as fit and proper, holds a Statement of Responsibilities, and is subject to the Conduct Rules and the Duty of Responsibility. What sets the risk function apart is that its value depends on its independence: a CRO who cannot challenge the business, or who is captured by it, is not discharging the function the regulator expects.

SMF Capital sets out the function in depth in its guide to the SMF4 Chief Risk Officer function, and runs dedicated SMF4 Chief Risk Officer recruitment; its complete SMF designations guide shows how the risk function sits among the governing and required functions.

Why Independence Defines the Role

The CRO is the second line, not the first

Under the three-lines model that regulated firms are expected to operate, the business owns and manages its risks (the first line), the risk and compliance functions provide independent oversight and challenge (the second line), and internal audit provides independent assurance (the third). The CRO sits in the second line. Their job is not to run the business or to take the risks, but to own the framework within which risk is taken and to challenge it independently. A CRO drawn too far into first-line decision-making loses the independence the function depends on.

Access to the board matters

An effective CRO has a direct line to the board, typically through a risk committee, and the standing to escalate concerns over the heads of the executive where necessary. The regulator expects the risk function to be positioned so that it can give the board an unvarnished view of the firm’s risk profile. A CRO buried in the management line, reporting only through the chief executive, cannot provide that assurance. The function frequently works alongside a risk committee chair and the firm’s non-executive directors.

Independence of judgement and of mind

Independence is structural, but it is also personal. The best CROs combine technical command of the firm’s risks with the temperament to hold a position under pressure and the judgement to know which risks matter. Assessing an SMF4 candidate means testing both: the technical risk expertise, and the independence of mind to challenge a confident executive team when the framework requires it.

What the Board Is Really Hiring

An SMF4 appointment asks for risk leadership and regulatory standing at once. The first is command of the firm’s risk landscape — the material risks it runs, the framework to manage them, and the judgement to advise the board. The second is the regulatory dimension: an understanding of the chief risk function’s role in the firm’s governance, the credibility to be assessed as fit and proper, and the independence the function depends on.

• A risk leadership record appropriate to the firm’s scale, business model and risk profile;
• Command of the firm’s material risks and of a risk management framework proportionate to the firm;
• The regulatory credibility to be assessed as fit and proper for the chief risk function;
• The structural and personal independence to provide genuine second-line challenge;
• The judgement and temperament to discharge the Duty of Responsibility for the firm’s risk framework.

The SMF4 works closely with the firm’s governing functions — the chief executive (SMF1) and the chief finance function (SMF2) — and, at insurers, with the Chief Actuary (SMF20), given how closely the actuarial and risk functions interlock. A CRO who understands how risk accountability fits with the finance, compliance and (where relevant) actuarial functions is worth more than one who treats risk in isolation.

How to Run the Search

A regulated CRO search rewards a structured, research-led and confidential approach. The brief should be explicit about the firm’s regulatory status, its risk profile and how the risk function is positioned in the governance structure, so candidates are assessed against the independence and regulatory dimensions from the outset. The strongest candidates are usually in post and reached directly.

Exec Capital runs these as retained searches. Briefing covers the firm’s regulatory status, its risk profile and the positioning of the risk function as well as the risk leadership brief; research maps candidates with both the risk record and the regulatory standing the function demands; approach and assessment test technical risk expertise and independence of judgement; and the shortlist carries assessment commentary that speaks to fitness and propriety. We support the firm through interviews, offer, the Statement of Responsibilities and the regulatory approval process.

Where the firm is building out its regulated leadership team — appointing a chief risk function alongside a chief executive, a chief finance function or the compliance oversight function (SMF16) — we coordinate the searches so the second-line functions fit together and the risk function’s independence is preserved.

Frequently Asked Questions

Does every regulated firm need an SMF4?

The chief risk function is a required function at larger and more complex firms, and the requirement depends on the firm’s SM&CR classification. At smaller firms the risk responsibilities may be held alongside another function. The firm’s regulatory arrangements confirm whether a standalone chief risk function is required.

Can the CRO also run part of the business?

Combining the chief risk function with a first-line business role undermines the independence the function depends on and is generally avoided. The CRO’s value is as an independent second-line check; a holder who also owns first-line risk-taking cannot provide that. Where resource is constrained, the answer is usually a proportionate risk function, not a conflicted one.

Can SMF4 be held on a fractional basis?

At smaller firms a fractional or part-time chief risk function can work, provided the arrangement gives the holder real responsibility and genuine independence, and the regulator is satisfied they can discharge it. What the firm cannot do is appoint a risk function in name only while the real decisions sit unchecked in the business.

Sources and Further Reading

• FCA — Senior Managers and Certification Regime
• FCA Handbook — SUP 10C (FCA senior management functions)
• Bank of England / PRA — prudential regulation