Executive search for heads of prudential risk

A head of prudential risk owns the firm’s capital and liquidity assessments: the ICAAP, the ILAAP, the stress testing behind both, the Pillar 2A and PRA buffer figures that follow the supervisory review, and often the recovery plan and the returns. In most banks the role reports to the chief risk officer, who holds the PRA’s Chief Risk function, SMF4. In some it sits in finance under the chief finance officer, SMF2, who is responsible for managing the firm’s financial resources.

The PRA says the prescribed responsibility for the production and integrity of the firm’s financial information and regulatory reporting is often shared between the Chief Finance and Chief Risk functions, and the responsibilities for capital, funding and liquidity and for the internal stress tests must sit with approved senior managers in any firm above the £250 million small-firm threshold. This role does the work beneath one or both of those people, and the brief has to say which.

The title also covers two jobs: a second-line role that writes the ICAAP and challenges the capital plan, and a first-line role that runs the plan, the returns and the funding. In a small bank one person does both. We settle which it is before the market map starts, because the strong candidates ask on the first call.

Sources: PRA Rulebook, Senior Management Functions Part, rules 3.3 and 3.4; Allocation of Responsibilities Part, rules 3.1 and 4.1; PRA SS28/15, April 2026, paragraphs 2.26 and 2.41.

Usually not. In most banks and building societies the head of prudential risk is a certification function: the firm assesses the person as fit and proper and certifies them itself, then repeats the assessment every year. The prescribed responsibilities for capital, funding and liquidity and for the internal stress tests sit with the approved senior managers above the role.

It becomes a senior management function in two cases we meet: where the firm gives the person overall responsibility for an area and they hold no other approved function, the FCA’s SMF18; and where a smaller firm’s activities do not justify a separately appointed chief risk officer and this person performs that function without a conflict of interest, SMF4. The regulator then has a statutory three months from a complete application, and the criminal record check must be no older than six months at submission.

For a certified role the constraint is usually the notice period: a head of prudential risk three months from an ICAAP submission is rarely released early, so a search that starts after the resignation lands in the middle of your own cycle. We map the two calendars in the brief.

Sources: PRA Rulebook, Certification Part, rules 2.1 and 2.2; FCA Handbook, SUP 10C.7.1R and SUP 10C.10; PRA SS28/15, April 2026, Table E; PRA PS12/26, 22 April 2026, paragraphs 2.20 and 2.85.

The chief risk officer or the chief finance officer usually owns this hire, and the other has a view, because the responsibility for financial information and regulatory reporting is so often shared between them. The chair of the risk committee, responsible under the PRA’s guidance for safeguarding the independence of the risk function, wants to know the second line will still challenge the capital plan; the board, which must approve the ILAAP, wants a document it can read.

With HR, in-house talent acquisition and RPO teams we split the work: they own the process and the offer; we bring the map of the senior prudential risk market and a technical screen a generalist team cannot run (see talent acquisition teams). If the role has grown into a chief risk officer’s job, see chief risk officer search. The same firm does advisory, training and the RisKIT models, so a search can be paired with interim advisory cover from Risk Advisory while the role is empty.

Sources: PRA SS5/16, paragraph 4.3; PRA Rulebook, Internal Liquidity Adequacy Assessment Part, rule 13.1; PRA SS28/15, April 2026, paragraph 2.41.