Where the jobs are: Chief Risk Officers

4 May 2005

7 minute read

Last fall, Fannie Mae ran afoul of its regulator, the Office of Federal Housing Enterprise Oversight, amid accusations that it had violated accounting rules. To pacify OFHEO, Fannie Mae agreed to appoint a chief risk officer to oversee the company's myriad financial and operational risks going forward.

"That was a significant step forward in the public profile of the chief risk officers in corporate America," says Mike Corey, a Chicago-based vice chairman and global head of the financial-services practice at recruiting firm Highland Partners. "There are not many people out there with the right blend of skills to be able to do this job, but there is a steadily growing demand for them."

A decade ago, corporate America had only a handful of chief risk officers, almost exclusively working within large banks. But a flurry of financial scandals that culminated in the Enron and Worldcom debacles, highlighted the increased number and growing complexity of the risks that American companies were running every day. The conviction grew that having someone charged with the task of monitoring all kinds of risk would help a company avoid a range of business setbacks. The result: steady growth in the number of companies creating the position of chief risk officer.

"Businesses need to be able to take risk in order to make money, but they need to know how to do so wisely," says Leslie Rahl, founder of Capital Market Risk Advisors, a New York-based consulting firm. Ms. Rahl, who is often consulted by headhunters or chief executives seeking a chief risk officer, says she sees the role as just as important as any other top-level executive position.

Unlike an auditor, who tries to figure out what has just happened, a chief risk officer's job is to ensure an auditor finds that nothing has gone amiss. That means evaluating everything from the company's accounting policies and procedures to its technology network. A good chief risk officer should be able to flag accounting problems, ensure the company is keeping up with regulatory requirements and be confident that sudden currency or commodity-price moves won't lead to large losses. Their task is to ensure that the business functions exactly as it should: If their faces end up on magazine covers, it will be because they have failed and poor risk management has caused financial disaster for their company.

While their work may be anonymous, the rewards are increasingly generous. "This is a job that very few people have the background or the skills to do well," says Alan Hilliker, a partner at recruiting firm Egon Zehnder International Inc. and head of its financial-services practice. "The demand has soared, and their compensation has gone into the stratosphere as the risks of running afoul of regulators - one of the things a good CRO can guard against - have escalated."

Mr. Hilliker says a veteran risk manager taking the top job at a major financial institution may be able to earn $2.5 million to $3 million annually in salary and bonus, up from a paltry $750,000 five years ago. (The median annual total compensation for a chief risk officer is $886,413, according to a 2004 survey by Risk Talent Associates, a specialized recruiting firm in New York.) There are other signs of their higher status: The title of chief risk officer is more often used, and these individuals may report directly to directors. Part of this trend can be traced to the fact that CROs are now in growing demand within all parts of the financial-services industry, not just the multinational banks. Mr. Hilliker estimates that half of medium- to large-size asset-management firms have an independent risk manager or CRO today, up from only 10% three years ago. In a few years, he calculates, few will be without such a senior position.

Hedge funds are also actively recruiting CROs. "Large hedge funds need to be able to reassure their investors they are paying attention to risk and compliance issues," says Michael Woodrow, president of Risk Talent Associates.

But demand for risk-management talent is now spreading beyond Wall Street, and the multinational banks where veterans honed their skills are now prime recruiting grounds for headhunters. The energy industry has been the most aggressive, with generating companies and utilities recruiting risk managers to oversee their intricate webs of energy-supply contracts and regulatory issues. Duke Energy created the position of CRO in 2000 and handed the job to its former chief financial officer, Richard Osborne. Two years later, in the wake of the Enron debacle, a group of energy companies created an industry committee of chief risk officers, who are working to create best-practice guidelines.

PMI Group, a Walnut Creek, Calif.-based mortgage-insurance company with overseas operations, created the position of chief risk officer in 2003 and named Joanne Berkowitz, then a 20-year veteran at the company, to the post. Previously, she had served as CRO of PMI Capital Corp., the unit overseeing PMI's international operations. "We adopted the position earlier there to monitor what was happening in that complex arena," she says. Ms. Berkowitz's mandate is to ensure the company has a process for identifying and managing everything from financial to operational risks, a task that includes oversight of the internal-audit function. She is recruiting a small group of midlevel risk managers to help, particularly with audit and compliance issues. "Our need for these people is only going to grow," she says. "But they are thin on the ground."

When companies can't find a dedicated CRO, they may turn to someone like Robert Endres, president and chief executive officer of Houston-based Synaptic Decisions, a year-old consulting firm. He and his seven-person team are called in to advise clients on risks in contracts for sales, equipment leasing, transportation and other business operations. "We look for things that might expose our client to risks they aren't aware they are taking," Mr. Endres explains.

But Mr. Endres's biggest challenge, he says, is recruiting his own team. He has tapped the oil patch to do so, recruiting Neil Behrens, a veteran manager of commodity-related risks as a partner, and another former energy-industry executive and consultant as a director of his firm. He is seeking a unique set of skills, Mr. Endres explains: "We need people who understand whole sets of risks and how to detect them in all kinds of places. Finding [qualified candidates] has really been a challenge."

MR. Corey says that's true of all senior-level risk-manager-recruiting mandates he has been handed. Finding someone with the right mesh of strong quantitative skills and a broad-based knowledge of business is akin to locating the Holy Grail. Mr. Corey says he recently filled a CRO position at a large international bank -- a job that carried a $1.5 million annual compensation package - by tracking down a skilled actuary was now working in the Caribbean for an offshore investment fund. "It's lucky to find someone that perfect," he says. "Yes, the people with the quantitative skills are there, but you also need that understanding of the business world," he says, so that risk managers are alert to new or different kinds of risks that are just emerging and know how to gauge when a risk is worth taking.

Even behemoth Fannie Mae hasn't found the CRO quest to be a simple one. Last winter, the company named Adolfo Marzol, formerly senior vice president of corporate strategy, to the post of interim chief risk officer. But as of early May, the search for a permanent CRO was still open.

For a snapshot of compensation for capital-markets risk executives, see CareerJournal.com's Pay Table.