Executive search for enterprise risk leaders

Strong candidates come from four places: heads of enterprise risk or risk frameworks at other regulated firms; deputies in larger risk functions who have run the risk appetite refresh; credit or operational risk specialists who want breadth and have written the risk chapters of an ICAAP; and, less often, consultants and former supervisors who know what good looks like but have not run it inside a firm.

We test three things hardest. Whether the person can hold the first line to account: someone who has never told a business head that a limit will be reported as breached is not yet the hire. Whether they can write, because the appetite statement and the committee papers are documents the supervisor reads. And scale: in a smaller firm the same person writes the policies, builds the reports and answers the committee’s questions with one or two analysts.

The interviewers have held these roles: former chief risk officers and heads of risk, former regulators and interim executives. In the technical screen we ask for the last risk report a candidate wrote for a board committee, then what the committee should have asked and did not.

24 April 2026PS12/26 changes to senior manager approvals take effect

Usually not. Neither regulator’s list of senior management functions for a bank names enterprise risk, so in most firms the role is a certification function: the firm certifies each year that the person is fit and proper, rather than the regulator approving them. Regulatory references still apply, and the PRA expects a criminal record check, with the candidate’s consent.

Approval is needed where the head of enterprise risk performs the Chief Risk function, SMF4, or holds overall responsibility for an area under the FCA’s rules with no other approval (SMF18, other overall responsibility). The regulator then has a statutory three months from a properly completed application, and the clock stops whenever it asks for more information; the work before the application takes longer than the application.

Where an approved person has already left, our interim chief risk officer page explains how the role is covered while the permanent search runs.

Sources: FCA Handbook, SUP 10C.7.1R, 10C.10.26G and 10C.10.28G; PRA Rulebook, Certification Part, rules 2.1 and 2.2; PRA PS12/26, 22 April 2026, paragraph 2.20; SS28/15, April 2026, paragraph 4.19.

The chief risk officer owns this hire; where the CRO role is open too we run the two searches together (see chief risk officer search). The chair of the risk committee, whom the PRA holds responsible for safeguarding the independence of the risk function, usually meets the final candidate.

HR, in-house talent acquisition and RPO teams own the process and the offer; we bring the senior risk market map and the technical screen, for one hard-to-fill role or a whole programme (see talent acquisition teams).

The same firm does advisory and consulting, training and the RisKIT models, so a search can be paired with interim advisory cover on the framework or the ICAAP through Risk Advisory, or with board risk training for the committee the new head reports to. A founding partner has recruited risk leaders since 2003; the rest of our searches are listed under Risk Talent.

Sources: PRA SS5/16, July 2018, paragraph 4.3; PRA SS28/15, April 2026, Table F.