C-suites gaining another member: increasingly, larger companies are naming a chief risk officer to oversee complex risk management strategies. Financial Executives Research Foundation (FERF) looks at this evolving role and who is filling it.

Faced with challenges created by terrorism, corporate scandals and regulations such as Sarbanes-Oxley or Basel II, corporate governance and risk management has received increased focus over the past few years. Part of this focus has included the creation, or enhancement, of the role of chief risk officer (CRO). But the role still isn't common, and at companies that do have one, the question remains--just who is the CRO? Based on recent Financial Executives Research Foundation (FERF) research, the answer is: it depends.

[ILLUSTRATION OMITTED]

According to Brendan Burnett-Stohner, vice chair of Christian & Timbers LLC, an executive recruiting firm, the CRO role has largely developed during the past four years. One of the reasons, she says, is the recent consolidation of the banking industry, which has seen many regional banks being absorbed by larger entities.

CROs from financial services have a "perfect profile," she says, which includes: review of banking regulations, participating in annual Securities and Exchange Commission (SEC) meetings, working with credit rating agencies, overseeing and defining risk management policies in compliance with Sarbanes-Oxley and Basel II, meeting with major investors and responsibility for internal controls.

Broadly speaking, the CRO typically reports to the CEO or CFO, acting as champion of the company's enterprise-wide risk management (ERM). According to the 2003 Overview of Risk Management report from the Casualty Actuarial Society, the ERM organizational structure (such as the CRO, the CRO's staff and the risk management committee) should be accountable and have the authority to be a change agent. "Senior sponsorship needs to be high enough in the organization to have a top-level view of all the risks facing the enterprise, see across all organizational 'silos' and have sufficient authority to effect changes in business practice," the report states.

Burnett-Stohner's sense of the timing of the CRO emergence dovetails with that of two Tillinghast-Towers Perrin consultants, Jerry Miccolis and Charles Lee, who wrote in a 2002 article that "less than one-third of companies practicing some form of ERM have a CRO (the proportion is smaller in the U.S. than in Europe), and almost half of these CROs have been in place for a year or less.

"The relatively small number of organizations that have taken the step of appointing a CRO suggests that it is not a trivial matter," Miccolis and Lee added. "The problem has been determining just what this new creature should look like. That is, what's the right role, the right responsibilities and the right competencies for a CRO?

"Moreover, there is a wide variety of disciplines from which CROs come. According to our surveys, they are auditors, actuaries, financial engineers, strategic planners, lawyers, investor relation specialists, line operation managers, hazard risk managers--even HR specialists."

CRO profiles

The questions about what is the right role persist, but Burnett-Stohner provides three basic CRO profiles used in most companies. The first, and broadest, is one in which the corporate risk chief is responsible for enterprise-wide risk management. This structure is comprised of teams of people who reside in each business unit.

Each team reports to the CRO and the business unit head and is responsible for managing all risks--from operational and market to financial risks. This type of CRO would also have business continuity planning reporting to him or her and have a budget for management information system development, instead of relying on business unit budgets.

The more complex a business, she says, the more likely a company will have an enterprise-wide risk management program with a more powerful CRO who reports to the CEO and audit committee (or to the risk committee that is typically a subset of the audit committee). In cases such as Ford Motor Credit Co., Bank of Montreal and Charles Schwab & Co., Burnett-Stohner points out, some CROs have COOs reporting to them.

The second type of CRO is one that manages enterprise risk "through influence." This type of risk chief will not have direct report staff, but instead will monitor risks by developing relationships with business unit leaders. For example, Burnett-Stohner says, Bank of America Corp. first defined its CRO role based on this profile. Over the past 18 months, she says, its risk chief has built a support team, making the CRO role a broader one.

The third category of CRO is one who reports to a company's CFO. Depending on the company, this person may or may not be responsible for enterprise-wide risk management. Though Burnett-Stohner prefers the first CRO profile, she acknowledges that for some companies, this more limited structure is appropriate.

Regardless of the structure, she says that many companies--among them Continental Airlines Inc., Cargill Inc., The Coca-Cola Co., Louis Dreyfus Global and Tyson Foods Inc.--have a CRO. The prevalent use of derivatives and commodities within the energy and financial services, insurance and food industries tend to aggregate risk management and lead to creation of more chief risk officer posts. A 2003 survey by PricewaterhouseCoopers found that 57 percent of the 44 insurance companies sampled had a CRO who reported to the board of directors.

The Story at The Williams Cos.

For example, at The Williams Cos., a $12 billion energy company, Andrew Sunderman, vice president and chief risk officer, is responsible for strategy and analysis of commodity and credit risk, and for the development of risk management strategies involving capital allocation decision-making for the company's three non-regulated businesses. (The company has four businesses--natural gas exploration and production, midstream gathering and processing, gas pipeline and power. The regulated gas pipeline business is not overseen by Sunderman, though individuals within that business are responsible for credit risk management.)

His duties focus on researching, analyzing and communicating risks--as well as decision-making--within these three businesses. He also interacts with treasury, since derivative use requires ongoing liquidity management and forecasting. Based on his experience on the board of directors of an industry-wide committee of CROs, he says his role is similarly structured to those at other companies, particularly in the energy sector.

Williams' CRO role, created in July 2003, was envisioned as a strategic tool to help the company grow share-holder wealth, rather than in reaction to terrorism, corporate scandals or new regulations. Sunderman reports to the corporate CFO of Williams and also works with each business unit CFO. This structure calls for the CRO to report findings to the company's risk management committee, comprising a group of senior executives to whom Williams' board has delegated authority to manage credit and commodity risk (the CRO chairs the committee).

Risk reporting is also integrated with the company's existing Sarbanes-Oxley 302 and 404 processes. Because Sunderman is also CRO of Williams' power business unit, he has a unique understanding of overall risks relative to the consolidated financial statements.

[ILLUSTRATION OMITTED]

Newer Risks to Manage

In Burnett-Stohner's experience, approximately 60 percent of companies with a CRO either combine the chief credit officer (CCO) duties with CRO duties or call for the CCO to report to the risk chief. For the remaining 40 percent, the two function as peers.

For Williams, however, credit risk is managed at the business-unit level because the company determined that there was no strategic need to consolidate this function. Operational and environmental risks are also managed within each unit, while insurance coverage is managed separately by another internal group.

Ruud H. Bosman, executive vice president at FM Global, a commercial and industrial property insurance company, says that the global focus on corporate governance in the last five to seven years has resulted in companies trying to manage newer risks in conjunction with more traditional risk. FM Global typically works with risk managers rather than CROs, says Bosman, to help them identify risk exposures, devise loss prevention and control solutions and provide insurance to help minimize the overall financial impact of a loss.

[ILLUSTRATION OMITTED]

"How risk management is delegated within an organization will depend on the company," he says, "but from my perspective, risk management starts with the company's CEO and board of directors having awareness of business risks. The presence of the CRO is not as important as the fact that a company's leadership should deal with risk in whatever shape or form and make [informed] decisions. At the end of the day, [risk management] really is an issue for which the board of directors and CEO need to take the lead and be specific about what should be done."

Sunderman agrees. "Any company that wants to allocate capital properly needs to analyze and understand risk--whether or not a company chooses to do so with a CRO will depend on facts and circumstances." He suggests that when there are risks common to multiple business units, a company may want to consider aggregating risk management.

"It is the responsibility of business unit leaders, who are responsible for investing capital to price and manage risks," he says. "[A CRO may be] prevalent in certain industries because of involvement in the derivatives market. A company can manage its own commodities and related risk at the entity level, but hedging commodity risk through the use of derivatives may result in overpaying. Since derivative use is an integral part of Williams' business, the company's strategy is to consolidate derivative risk management at one level."

[ILLUSTRATION OMITTED]

Ideally, says Burnett-Stohner, a company should strive to integrate risk management into each person's job so that all consider risks as part of their everyday routines. For those companies that opt for a CRO role, she says, the current trend is to fill the slot from the ranks of line business leaders--people who are used to managing risk in every iteration all day, every day.

"When we're looking for CROs," Burnett-Stohner says, "we frequently go to energy companies and commodities trading. Going for line business management is tough, though, because it may be a step down [in position]." That means, she says, that companies have to pay appropriately and provide the opportunity for a candidate to have "a larger role down the line."

Cheryl de Mesa Graziano, CPA ([e-mail]), is Director of Research at Financial Executives Research Foundation. Raj Aggarwal, Firestone Chair in Finance/Business at Kent State University, is also a FERF Trustee.

RELATED ARTICLE: takeaways

* The chief risk officer role is a relatively new one, and there are several different models that companies seem to be choosing from.

* There is no one discipline that the risk officers draw from, though increasingly they are being recruited from line management positions.

* Some CROs report to the CFO, others to the CEO or the board of directors. The more complicated the risk management, the more prominence the position has.

* Companies in energy and financial services, insurance and food industries, with their heavy usage of derivatives and commodities, have tended to create CRO jobs.