Efficiency and Effectiveness in Risk/Compliance Functions

CRO Function needs significant upgrade in many banks to effectively deal with an increased complexity and ambiguity of its environment.

CRO Function leverages capabilities and talent for digital, AI/ML, robotics

• Function underestimates power of data- and robotics-driven risk models - advanced analytics improve accuracy and speed of decision making
• Function has limited view on risk tech, Fintech partners and respective offering as well as talent with relevant capabilities

CRO Function fully focuses on value-add services for business functions

• Function requires focus towards execution of value-add services for the bank’s business functions and senior management
• Need to scrutinise the function’s operating model towards the execution of services that help to improve decision making and provide relevant information

Responsibilities of 1st and 2nd LoD follow clear and strict separation

• Banks’ overall organisations lack clear separation of responsibilities between 1st and 2nd LoD – often, 2nd LoD responsibilities sit with the 1st LoD (i.e. business functions)
• Need for consequent localisation of control and oversight duties in 2nd LoD to ensure compliance of conduct across the overall organisation

CRO Function actively participates in setting the bank’s strategic agenda

• Needs to foster its involvement in setting the bank’s and BUs’ strategic agenda re e.g. market- and product push
• Needs to strengthen its overall steering and control capabilities re ‘change-the-bank’ (CtB) processes and activities (e.g. product acceptance involvement & process)

Risk strategy and risk organisation align with the bank’s strategy

• Function’s role and mandate required to follow the strategic needs of the bank – risk strategy aligns with the bank’s strategy
• Identified ‘TopRisks’ need to align with strategic agenda of the bank – function is required to orientate its organisational set-up accordingly
  

CRO Function follows a functional orientation and operating model

• Function still ‘thinks’ in risk categories instead of risk functions – immediate need to transform function’s operating model to lift scale efficiencies
• Pooling of the function’s resources and capabilities towards e.g. controls, methodologies/models, reporting, investigations, etc. is core in this regard