What a Difference a Pandemic Makes: Risk Management Is Having Another Moment

To upend an old adage, it's the worst of times, with the world still reeling from the COVID-19 pandemic and its devastating health and economic consequences. And yet, it's perhaps the best of times to be a risk professional.

There's nothing like a crisis to put risk management on everyone's map and prioritize a range of pressing issues - pandemic-related and otherwise. It has raised the profile of risk practitioners while reinforcing other organizational and outside-the-box opportunities for the profession.

“The pandemic has really cast a focus on risk management, and not just within banking where it's necessary to have strong buffers in place and strong enterprise risk management pieces, but outside of financial services,” observed Robert Iommazzo, co-founder and managing partner of SEBA International and head of the search firm's global Finance & Risk practice.

“The value placed on risk management has never been greater,” noted James Lam, president of consulting firm James Lam & Associates.

Lam has been credited with coining the chief risk officer title while serving in that capacity in the 1990s at GE Capital Markets Services and Fidelity Investments. He was the E*TRADE board risk committee chair before the brokerage company was acquired by Morgan Stanley last year, and recently became board chair of Recology, a $1 billion, employee-owned waste management company.

“It's a Cinderella moment,” Lam said.

Or call it a renaissance.

Flexing the Muscles

Consider Clifford Rossi, principal of Chesapeake Risk Advisors and professor-of-the-practice and executive-in-residence at the University of Maryland's Robert H. Smith School of Business, who was Citigroup's consumer lending division CRO during the 2008 crisis.

These days, Rossi is collaborating with faculty colleagues on projects that he characterized as being “at the nexus of climate science and financial risk analytics,” with “applicability” for corporations, official entities like the Federal Emergency Management Agency, and local governments.

Additionally, Rossi revealed that he has lately had the chance to flex his risk muscles assisting the U.S. Food and Drug Administration as part of an Office of Management and Budget mandate to federal agencies to incorporate enterprise risk management (ERM) into their decision-making.

Giving Back

Matthew Feldman, who retired at year-end 2020 as president and chief executive officer of the Federal Home Loan Bank of Chicago, who was at the helm for 12 years, and whose path to the top included a stint as CRO, mentioned he is on the Evanston (Illinois) Community Foundation board. It is the agent for a community reparations fund that has received national attention as perhaps the first of its kind and may become a model for other municipalities. Such racial justice work isn't standard risk management fare.

Also active with the Kellogg School of Management at Northwestern University, where he received his MBA and is a member of its Global Advisory Board and Inclusion Council, Feldman is assisting as a volunteer on a project connected to a $30 billion JPMorgan Chase & Co. commitment to advance racial equity.

And Feldman in June joined Lam on the Recology board.

Lam referenced the presence of two former CROs with no waste management background, but with risk skill sets, board experience and, in the case of Feldman, top executive experience and an extensive business-line management background, as a “milestone” that “speaks a lot about the recognized value that risk experts can bring to a corporate board.”

Levels of Confidence

In a May blog post about the 12th edition of Deloitte's Global Risk Management Survey, Deloitte Risk & Financial Advisory partner J.H. Caldwell wrote: “Most respondents indicated they believed their institutions are extremely or very effective at managing financial risks. Though, substantially fewer felt that way about nonfinancial risks such as operational resilience, cybersecurity, conduct and culture - all of which were made more prominent with the onset of the pandemic.”

Clearly, risk managers have their work cut out for them and will need to expand upon their skill sets to meet the ever-evolving challenges.

Caldwell singled out an “increased focus on credit risk,” which was “named the top risk type that will increase most in importance over the next two years.” Cybersecurity and environmental, social and governance (ESG) risks were also high on the list, and third-party risk was deemed “a major and complex problem.”

Skills in Demand

Iommazzo indicated he is “in conversations” with both a consumer products company and a manufacturer/distributor that are interested in creating new positions heading up ERM around supply chain and business continuity risks.

What's more, the SEBA practice leader has seen a “strong uptick” in searches over the last three months, with strong financial risk and treasury-related skills still among those in demand.

He acknowledged that burnout has been a problem because of the pandemic, but it hasn't led to an “exodus” of talent. The average tenure for a “true C-suite” risk and compliance executive is still about seven years, he said.

Risk managers have come a long way since the 2008 financial crisis, rising in corporate stature and increasingly appreciated for the strategic value they bring to their companies. They have secured coveted spots in the C-suite and started to make inroads into boardrooms.

On the Firing Line

But the successes put a harsher spotlight on results and accountability. CROs can be sacrificed, forced to take the fall for things that go wrong on their watch.

Credit Suisse CRO Lara Warner, an executive board member since 2015, left in April following the Archegos Capital Management collapse, which according to the bank's second-quarter earnings report cost it $5.5 billion pretax in the first half of 2021. (Credit Suisse has recruited David Wildermuth, a Goldman Sachs deputy CRO and 34-year banking industry veteran, to succeed Warner.)

“Anybody who sits in that CRO seat, with an event of that magnitude and headlines of this sort, has to know their days are numbered,” reasoned Rossi.

Then there's the flip-side opportunity for the high-profile CRO, the possibility of reaching the crown-jewel pinnacle of CEO.

“The skill set of a good CRO is not far afield from that of a good CEO, especially if the CROs are thinking about all of the stakeholders, even the ones the CEO may not necessarily be thinking about,” shared FHLB Chicago retiree Feldman, speaking from firsthand experience. On a similar career path, Michael Ericson, who succeeded Feldman as CEO on January 1 and was most recently chief operating officer, served as CRO from 2008 to 2014.

Other examples of ex-CROs who rose to CEO include: Carsten Egeriis of Danske Bank (announced April 2021); Steven van Rijswijk, ING (July 2020); Mahesh Aditya, Santander Consumer (December 2019); and Michael Pizzi, E*TRADE (August 2019).

Too Much Rigidity

Such CRO-to-CEO stories remain few and far between. When asked why, Feldman posited, “Most organizations operate in such rigid silos,” there may be a “presupposition that certain roles lead to the CEO position and others don't.”

“I don't think it's healthy,” he opined. “I learned a long time ago that to optimize talent in an organization, you need to give people multiple opportunities to learn from different perspectives, to force them to leverage the talents they have and to break down silos.”

“Just as chief financial officers truly became a strategic adviser to CEOs in the early 1990s, I believe we're at the forefront of that now for the CRO in financial services,” SEBA's Iommazzo stated.

Boardrooms are expected to be another realm ripe for risk talent. Many banks are under regulatory mandates to establish standalone board risk committees, and the experts advocate that this step be taken by all companies.

On August 13, Credit Suisse chairman AntÓnio Horta-OsÓrio stressed the “deep experience in risk management and business leadership” of two new board nominees, Axel Lehmann and Juan Colombas. Both have served as CROs - Lehmann at UBS and Zurich Insurance Group; Colombas at Lloyds Banking Group, where Horta-OsÓrio was chief executive - and on board risk committees.

“We need people who have that background on these boards more than ever,” Lam maintained.

“To this day, [companies] have not made that much progress getting risk people onto boards,” said Rossi.

Been There . . .

Iommazzo is observing more regional banks and financial institutions bringing former CROs on their boards.

A case in point: Kenneth Phelan, who capped a long banking career as CRO at Wachovia Corp., Fannie Mae and RBS Americas, and then was the U.S. Treasury CRO from 2014 to 2019, is a director of $175 billion-in-assets Huntington Bancshares, Columbus, Ohio.

It stands to reason, Rossi reckoned: “Unless you've done it” - been in a risk role - “you don't know how to ask the right questions.”

With opportunities opening up, now is a good time for risk professionals to take stock.

“The appointments of CROs at financial institutions and energy firms have become commonplace,” Lam offered. “Healthcare, retail, non-financial companies and government entities are the next frontier.”

In fact, Lam said he's advising three CROs - one in financial services, the others in integrated healthcare and retail.

Feldman's advice for risk professionals: “To think holistically about their organizations; to understand all of the stakeholders and their perspectives on what they need from the organization and the risks and opportunities that arise from that.”

He urged people to remember that “the organization - not just risk officers - is responsible for risk management.”

As for wishful thinking, Lam wondered why not “a CRO for the West Wing,” or in or connected to the president's cabinet.

“This will be in the cards at some point.”

L.A. Winokur is a veteran business journalist based in the San Francisco Bay Area.