Two candidates for Chief Risk Officer meet a board. One has spent twenty five years in credit risk and has led through several full credit cycles. The other came up through the bank's technology and data function, built the infrastructure behind the risk models, and sees risk as a product and data question as much as a methodology question.

The question of which to appoint now comes up in almost every risk mandate we discuss. The answer depends on what the board believes risk will mean for the institution in three years.

Why the question has arrived

Regulators across the GCC and India have raised expectations on operational resilience, cyber, model governance and third party risk. Banks are moving more origination and servicing into digital channels, where risk is created and managed in real time. And the data needed to manage credit well now lives in platforms that sit at the centre of the bank's technology.

The answer reveals what kind of institution a board wants to become.

Four questions we put to boards

  • Where will the institution's largest exposures most plausibly sit over the next three years: credit, operations, cyber, conduct or liquidity?
  • How mature is the existing risk function, and what strengths can the new leader build on?
  • What does the regulator expect, and what has the institution already committed to?
  • Who else sits at the executive table, and which capabilities will the new leader complement?

The leader who holds both

Increasingly, boards look for candidates who have worked on both sides: a credit professional who has run risk analytics or a digital lending business, or a technologist who has led a risk transformation and earned the respect of credit committees. For these candidates we assess credibility with the regulator and judgement under pressure with particular care.

What we assess, and how we align it

Within Aligned Acquisition, the four questions define the mandate as it truly is. We then assess each candidate on regulatory fit, depth in the risks the board has prioritised, command of data and models, and the culture of the risk function they will lead. The shortlist is compared on that evidence, against the same view of the future.

Before a board commissions the search, it can agree its own answer to the four questions and write it into the brief. The appointment then becomes a test of fit against a clear view of the future, which is a better decision for the institution and a fairer one for the candidates.