Risk Talent · Executive search
The test for a head of operational risk is whether they can challenge the chief operating officer and keep the relationship. RiskTAE runs retained searches for heads of operational and non-financial risk in banks, building societies, insurers, investment and payment firms, and interviews every candidate on it before you see a CV.
A partner runs the search from the written brief to the first day.
You meet people who can run the second line for operational risk in front of your board and your supervisor, with a start date planned around notice, references and any regulatory approval.
By Benn PopleUpdated
The role
Operational risk, as the UK Capital Requirements Regulation defines it, is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events, and it includes legal risk.
The head of operational risk runs the second line for that risk: taxonomy and control self-assessments, loss data and scenarios, and the reporting to the executive and the board’s risk committee. In most banks the role reports to the chief risk officer, who holds the PRA’s Chief Risk function, SMF4, and the Risk Control Part requires the risk function to be independent from the operational functions.
Neither regulator’s list of senior management functions for a bank includes operational risk, so the role is usually a certification function: the firm certifies each year that the person is fit and proper, rather than the regulator approving them. The operations and technology it challenges belong to the Chief Operations function, SMF24, so the first thing we settle in a brief is that boundary: a candidate at this level asks who owns the resilience self-assessment and the outsourcing register, and who challenges them.
Sources: UK CRR, Article 4(1)(52); PRA Rulebook, Senior Management Functions Part, rules 3.4 and 3.8, Risk Control Part, rule 3.4, and Certification Part, rule 2.1; FCA Handbook, SUP 10C Annex 1; PRA PS12/26, 22 April 2026, paragraph 2.20.
Scope
Firms must identify their important business services, set an impact tolerance for each and be able to stay within it through a severe but plausible disruption; the board approves both and reviews the self-assessment. The PRA expects SMF24, the Chief Operations function, to hold overall responsibility for implementing the policies, so the second line’s job is challenge, and we test who challenged the last self-assessment rather than who wrote it.
Senior managers cannot outsource their responsibilities, and the PRA expects notice before a firm enters or significantly changes a material outsourcing arrangement. A new version of SS2/21, published on 18 March 2026, takes effect on 18 March 2027 following PS7/26 on operational incident and third-party reporting, so your hire builds that reporting in their first year.
From 1 January 2027 a single standardised approach replaces the existing approaches under Basel 3.1, with the internal loss multiplier set to one, so the firm’s own loss history does not move the Pillar 1 number; SS14/13 is withdrawn the same day. Scenarios and loss data carry the operational risk argument in the ICAAP instead, and we test whether a candidate has seen that before the finance director asks. Our advisory practice covers operational risk capital under Basel 3.1.
Sources: PRA Rulebook, Operational Resilience Part, chapters 2 and 7, and Operational Risk Part, rules 4.1 and 5.9 (from 1 January 2027); PRA SS1/21, March 2022, paragraphs 4.14 and 7.4; SS2/21, November 2024 and March 2026 versions, paragraphs 4.3 and 5.14; PS17/23, 12 December 2023, paragraph 5.2; PS1/26, 20 January 2026, paragraph 2.14.
Candidates
Strong candidates come from three places: sitting heads of operational risk at other firms, who bring a framework that works; deputies in larger operational risk teams who have run the scenario programme or the resilience challenge and are ready to own the function; and, less often, people crossing from first-line control, internal audit, consulting or the regulator, who know the standard but have not yet run a second line.
We test hardest for two things. Whether the person has held a line with a chief operations officer or a business head and kept the relationship, because a second line that is ignored is worse than none. And scale: a head of operational risk from a large bank has run one part of a framework with a team of specialists, while in a smaller firm the same person writes the policy, runs the self-assessments and presents to the risk committee with two analysts.
Process
| Stage | What happens | What is different for this role |
|---|---|---|
| Brief | A 30-minute call, then a written brief: the role, first-year success, terms and timetable. | We settle the boundary with the chief operations function, and whether the role carries a senior management function. |
| Market map | The people who fit, most of whom are not looking, approached in confidence without naming you until they are interested. | Non-financial risk people rarely answer a generic approach, so ours describes the mandate and the reporting line. |
| Technical screen | Each candidate is interviewed on the substance before you see a CV. | By former chief risk officers and heads of risk, former regulators and interim executives. |
| Shortlist | A short list with our written view of each person, then interviews and feedback both ways. | We ask that the chief operations officer and the chair of the risk committee meet the final two. |
| Offer, checks and start | We handle the offer, plan the checks and stay close through notice and the first months. | Regulatory references over six years apply to this role too; our guide to regulatory references after PS12/26 sets out the timetable. The PRA expects a criminal records check for non-SMF holders too, with the candidate’s consent. |
Sources: PRA Rulebook, Fitness and Propriety Part, rule 2.7; PRA SS28/15, April 2026, paragraphs 4.19, 6.4 and 6.5; PRA PS12/26, 22 April 2026, paragraph 2.79.
Failure points
Source: PRA SS5/16, July 2018, paragraph 10.2.
Working with your team
The chief risk officer owns this hire, and where the CRO role is open too we run the two searches together; our chief risk officer search page explains how that hire differs. The chief operations officer works with the new head every week, so we ask them to agree the brief and meet the shortlist. The chair of the risk committee, whom the PRA holds responsible for safeguarding the independence of the risk function, usually meets the final candidate.
HR, in-house talent acquisition and RPO teams own the process, the employer brand and the offer; we bring the senior non-financial risk market map and the technical screen, for one role or a whole programme (see our page for talent acquisition teams).
The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover while the role is empty, or with training for the new head’s team, through Risk Advisory, and the rest of our searches are listed under Risk Talent.
Sources: PRA SS5/16, July 2018, paragraph 4.3; PRA SS28/15, April 2026, Table F.
FAQ
Usually not; in most banks it is a certification function, certified by the firm as fit and proper each year rather than approved by the regulator. Where a firm gives it overall responsibility for an area under the FCA’s rules and the holder has no other approval, the other overall responsibility function, SMF18, applies, with the regulator’s approval; our interim chief risk officer page explains how a role is covered while that approval is pending.
Yes. In many firms the title is head of non-financial risk and the remit takes in operational resilience, third-party risk and conduct risk. A non-financial risk leadership search runs the same way with a longer brief, and we test each part of the remit on its own; few people are equally strong on scenario analysis and on outsourcing.
Rarely. Head of operational risk recruitment at this level is mostly confidential, so the roles are not advertised and we approach people directly. If you are thinking about a move, book a confidential career call, message us on WhatsApp on +44 7537 159269 or email talent@risktae.com. We never put your name forward without your agreement.
Insights
A head of non-financial risk leads the second-line oversight of a bank's risks that do not arise from lending, trading or funding: operational risk, operational resilience, third-party and outsourcing risk, technology and cyber risk, and in some banks conduct and model risk. The role challenges the first line and reports on these risks to the CRO and the board.
By Benn Pople · 6 min read
The Business Indicator is the measure of size that sets a UK bank’s Pillar 1 operational risk capital from 1 January 2027. It is the sum of three components taken mainly from the income statement, each...
By Mark Dougherty, CPA (CAN) · 8 min read
Pillar 2A is the firm-specific capital the PRA requires a bank or building society to hold on top of its Pillar 1 minimum, for risks Pillar 1 does not capture or does not capture fully, such...
By Mark Dougherty, CPA (CAN) · 7 min readNext step
In 30 minutes we will agree the brief, say how the market is likely to read it and tell you whether a retained search is the right route.
Tell us about the role and a partner will come back to you. Treated in confidence.
Prefer email? talent@risktae.com or +44 20 3996 9599. We use these details only to reply to you: privacy notice.