Interim or fractional chief risk officer: which does your firm need?

The choice comes down to two questions. Could the firm have seen the vacancy coming, and does it need a chief risk officer every day? The rules answer the first; the firm’s size and risk profile answer the second.

What is the difference between an interim and a fractional CRO?

Time and continuity. An interim works full time for a defined period and then hands over; a fractional CRO works part of the week and stays.

The function is the same. The PRA defines SMF4 as “responsibility for overall management of the risk controls of a firm, including the setting and managing of its risk exposures”, reporting directly to the governing body (Senior Management Functions rule 3.4). Nothing in that turns on hours or contract length.

When does an interim CRO make sense?

When the role is about to be empty and a permanent successor cannot be approved in time. The usual triggers are a resignation with immediate effect, a long illness, or a search that will not finish before the incumbent leaves. It also fits a period when the firm needs a CRO in the room every day, such as a remediation programme or close supervisory attention.

The PRA expects the gap to be rare. SS28/15 paragraph 2.58C says it does not expect firms to use the 12-week rule frequently, expects “effective and up-to-date succession plans for each of its SMFs” and “will monitor firms’ use of the 12-week rule”. A CRO retiring next year calls for a permanent search started now.

When does a fractional CRO make sense?

When the firm needs a chief risk officer’s judgement and accountability, but its size and risk profile do not justify five days a week. The PRA’s guidance anticipates such firms: SS28/15 lists the Chief Risk function for banks and building societies “where proportionate” (Table B), and says those with gross total assets of £250 million or less “are not expected to have many Senior Managers in addition to the mandatory SMFs” (paragraph 2.7).

Availability is the test. Risk Control rule 3.4(3) requires that the risk function can “raise concerns and warn the management body”, and rule 3.5 that its head can “have direct access to the management body where necessary”. A CRO who cannot be reached between contracted days fails that test whatever the contract says, so put availability and escalation in writing.

Expect the days to be read against the statement of responsibilities. SS28/15 paragraph 2.46B says statements allow a candidate’s competence, knowledge and experience “and, where relevant, proposed time commitment” to be measured against the responsibilities allocated. A short week set against a long list of prescribed responsibilities invites questions.

Does an interim or fractional CRO need SMF4 approval?

Yes, unless the 12-week rule applies, and that rule is written for an employee of the firm standing in for an absent approved person. Approval attaches to the function, so the hours and the contract length make no difference.

The firm must first be satisfied the person is fit and proper (Fitness and Propriety rules 2.1 and 2.6), and every application carries a statement of responsibilities (Allocation of Responsibilities rule 2.1). Accountability starts on day one either way: PS12/26 paragraph 2.10 says the Senior Manager Conduct Rules should apply “to anybody performing an SMF role, even on an interim basis and without approval”, which includes a person covering under the 12-week rule (paragraph 2.11).

Can an interim cover under the 12-week rule?

Only where every condition in rule 2.3 of the Senior Management Functions Part is met, and the first concerns who the person is. The rule applies where “a firm appoints an individual who is an employee of the firm”, “solely to provide cover” for an approved person whose absence is temporary or reasonably unforeseen, for “less than 12 weeks in a consecutive 12-month period”.

An interim engaged through their own company or a supplier, rather than on the firm’s payroll, raises that first condition directly. Settle whether your interim falls within the rule before relying on it. If there is any doubt, plan on approval before they perform the Chief Risk function.

Rule 2.3A counts a person “ceasing to perform their PRA senior management function” as an absence, so a resignation qualifies. Since 24 April 2026, rule 2.3B extends the cover “until that application is finally determined” where the absence was reasonably unforeseen and the firm made “a valid and complete application” in time. The PRA kept the window at 12 weeks and says the rule is “not intended for vacancies that can be anticipated” (PS12/26 paragraphs 2.7 and 2.8). See how the 12-week rule works.

How quickly can each start?

A person covering under the 12-week rule, which applies to an employee of the firm, can perform SMF4 from appointment. Anyone who needs approval, including every fractional CRO, waits for the decision.

The firm’s own work comes first: six years of regulatory references (Fitness and Propriety rule 2.7), a criminal record check no more than six months old at submission (PS12/26 paragraph 2.85) and the statement of responsibilities. The regulator then has three months from a properly completed application, with the clock stopped while it waits for information (FSMA section 61(3A) and (4); FCA SUP 10C.10.26G and 10C.10.28G). The PRA’s median for senior manager cases was 28 days between December 2025 and February 2026, down from 62 days a year earlier (PS12/26 paragraph 2.19). Our SMF4 approval timeline planner turns an offer date and notice period into a likely start, and how long SMF4 approval takes explains the figures.

What drives the cost of each?

The days and the duration, then the weight of the role. Rates depend on the brief, and these are the factors that move them.

• Days and duration: contracted days on a continuing basis for a fractional CRO, full-time weeks for a defined period for an interim, sometimes overlapping the permanent CRO at handover.
• The statement of responsibilities: a CRO who shares responsibility for financial information and regulatory reporting with the CFO, which SS28/15 paragraph 2.41 says is often the case, answers for more.
• Regulatory weight: an ICAAP due, a Pillar 2A figure to defend or close supervisory contact narrows the pool to people who have done that work.
• Urgency: a vacancy that has already opened limits the field to people available now.
• The engagement route: through a supplier, the person’s own company or direct, which also bears on the 12-week rule.

A gap has a cost too. Outside the small-firm regime, if nobody performs the Chief Risk function, responsibility for the compliance of the firm’s risk management systems, policies and procedures must go to another senior manager (Allocation of Responsibilities rules 3.1(2) and 4.2(2)), on top of their own job.

What about a combined head of risk and compliance?

We search for permanent combined heads of risk and compliance. We do not supply interim or fractional compliance officers or MLROs, so the compliance side needs its own cover.

The two halves answer to different regulators: Chief Risk is a PRA function, while compliance oversight (SMF16) and money laundering reporting (SMF17) are FCA functions (SUP 10C.6.1 and 10C.6.2). The Basel Committee says that where “dual hatting” is unavoidable in smaller institutions, “these roles should be compatible” and “should not weaken checks and balances within the bank” (Corporate governance principles for banks, footnote 26). See our risk and compliance leadership search.

Which one does your firm need?

Work through five questions in order. The first three decide whether interim cover is needed and on what basis; the last two decide between full time and part time.

Our interim chief risk officer and fractional chief risk officer pages set out how we run each, and interim and contract risk professionals covers roles below CRO. For the document a candidate is measured against, see our chief risk officer job description template. Terms are defined in our glossary.

Questions readers ask

Does a small bank have to appoint a chief risk officer at all?

Not always. The mandatory functions are the chief executive, chief finance and chair (Senior Management Functions rule 2.2(1)). Where scale does not justify a specially appointed head of risk, “another senior person within the firm may fulfil that function, provided there is no conflict of interest” (Risk Control rule 3.5).

How long can an interim CRO stay?

Without approval, only while every condition of the 12-week rule is met, including that the person is an employee of the firm: less than 12 weeks in a consecutive 12-month period, extended where the absence was reasonably unforeseen until a valid and complete application made in time is finally determined (rules 2.3 and 2.3B). With approval, for the period agreed, unless the PRA limits the approval; for an interim covering long-term leave, SS28/15 paragraph 2.9B says approval “could be on a time-limited basis”.

Can two people share the CRO role?

Only in limited cases. SS28/15 paragraph 2.10 says a firm may be allowed to have more than one person performing a single SMF, “including but not limited to job-share arrangements”, but only “where appropriate and justified”, and each is individually accountable for all of it (paragraph 2.11).

Does a fractional CRO carry less accountability than a full-time one?

No. The function and the statement of responsibilities set the accountability, and the Senior Manager Conduct Rules apply to a fractional CRO as to any approved senior manager (Conduct Rules rule 1.1). What changes is the evidence that the days are enough.

Sources: PRA Rulebook, Senior Management Functions Part, rules 2.2, 2.3 to 2.3B and 3.4; Risk Control Part, rules 3.4 and 3.5; Fitness and Propriety Part, rules 2.1, 2.6 and 2.7; Allocation of Responsibilities Part, rules 2.1, 3.1(2) and 4.2(2); Conduct Rules Part, rule 1.1 (all as at 10 October 2026); FSMA section 61 (revised version as at 7 October 2026); PRA SS28/15 (April 2026 version), paragraphs 2.7, 2.9B, 2.10, 2.11, 2.41, 2.46B and 2.58C and Table B; PRA PS12/26 (22 April 2026), paragraphs 2.7, 2.8, 2.10, 2.19 and 2.85; FCA SUP 10C.10; FCA SUP 10C.6; Basel Committee, Corporate governance principles for banks (8 July 2015), footnote 26. Accessed 10 October 2026.