The SMF4 Chief Risk Function

SMF4 is the Senior Manager Function for the chief risk officer. The holder is accountable for overseeing the firm’s risk management, including the identification, measurement and management of its risks, and for giving the board an independent view of them. Under the Senior Managers and Certification Regime, SMF4 applies at Enhanced firms and at dual-regulated firms such as banks, building societies and insurers, where it’s designated by the Prudential Regulation Authority.

At Core firms, the risk role isn’t a Senior Manager Function, but many still need a head of risk, particularly investment firms running an ICARA and lenders managing credit and conduct risk together. SMF Capital recruits for both. Our SMF4 guide explains the function in detail. This page is about hiring one.

What the Regulators Expect From a Chief Risk Officer

• Independence. The CRO must be able to challenge the business, including the chief executive, without their pay or position depending on the areas they oversee.
• Direct board access, typically through the risk committee, with the standing to raise concerns directly.
• A risk appetite framework that the board approves and the business actually uses.
• Stress testing and scenario analysis that are severe enough to be meaningful.
• Capital and liquidity oversight, including the ICAAP for banks, ORSA for insurers or the ICARA under MIFIDPRU 7 for investment firms.
• Coverage of non-financial risks, including conduct, operational resilience, technology and third-party risk.

A CRO who reports mainly to the chief executive, lacks resources or is excluded from key decisions is a warning sign to supervisors.

Permanent, Interim and Fractional Chief Risk Officer Appointments

Permanent

Most Enhanced and dual-regulated firms need a permanent CRO who knows the business deeply, owns the risk framework and builds a relationship of trust with the board and regulators over years.

Interim

Interim CROs are used to cover vacancies, lead a framework rebuild after regulatory feedback, or support a firm through a major event such as an acquisition, a new licence or a move to Enhanced status. Where a Senior Manager leaves unexpectedly, the 12-week rule allows temporary cover, and since the April 2026 reforms the firm must submit an approval application within those 12 weeks if the person covering is to continue.

Fractional

Fractional risk leadership works well for smaller firms that need a credible, independent head of risk without a full-time cost, including MIFIDPRU firms needing support with the ICARA and smaller lenders or insurers. See fractional and interim SMF cover and our article on when fractional appointments work.

How We Run a Chief Risk Officer Search

1. Brief against the Statement of Responsibilities. We start from what the new Chief Risk Officer will actually be accountable for, including any Prescribed Responsibilities, not just the job title.
2. Direct, confidential search. Most strong candidates already hold roles and aren’t looking. We approach them discreetly, without naming your firm until the right point.
3. Fit and proper pre-assessment. Every candidate is tested against the fit and proper test before reaching your shortlist: prior approvals, regulatory history, directorships and financial soundness.
4. Shortlist and interview. Adrian Lawrence FCA interviews every shortlisted candidate personally. Our guide to interviewing an SMF candidate sets out the questions we use.
5. References and application. We start regulatory references early and support the approval application and Statement of Responsibilities.
6. Through approval to day one. We plan notice periods around the regulator’s timetable and stay involved until your new Senior Manager is in post.

What We Look For in CRO Candidates

The Right Risk Specialism

Risk leadership differs by sector. A bank CRO needs credit, market and liquidity depth. An insurer CRO needs insurance risk, reserving and capital modelling. An investment firm needs someone who can own the ICARA and assess the harms the business could cause. We specify the search around the risks the firm actually faces.

Evidence of Independent Challenge

The best candidates can describe specific occasions when they challenged strategy, pricing or risk-taking, and what changed as a result.

Board and Regulator Credibility

CROs present to the board and its risk committee and often meet supervisors directly. For dual-regulated roles, candidates may be interviewed by the PRA, so we test their ability to explain complex risks clearly.

Breadth Across Non-Financial Risk

Operational resilience, cyber and conduct risk have become central to the role. Candidates with only financial risk experience may need support in these areas.

Team Leadership

Most CROs lead a risk function, sometimes built from scratch. Experience of hiring, developing and resourcing a team matters as much as technical expertise.

CRO Recruitment by Sector

• Banks and building societies: credit, liquidity, capital and recovery planning under PRA scrutiny.
• Insurers and Lloyd’s: insurance and reserving risk, capital models and the ORSA.
• Investment managers: the ICARA, liquidity and investment risk oversight.
• Consumer credit: credit risk combined with conduct and affordability risk.

Timing and Approval

CRO appointments are among the most scrutinised. The PRA frequently interviews candidates for dual-regulated roles, and the regulators can take up to three months to decide a complete application. Senior risk leaders often have notice periods of three to six months. Planning should start early, and interim cover is often needed. Our SMF appointment timeline explains how the stages fit together.

The PRA also considers the board’s collective suitability, so a CRO appointment should be seen alongside the composition of the risk committee. Our chair and committee chair recruitment page covers the board roles that oversee the CRO.

Other Senior Manager Roles We Recruit

SMF Capital recruits across every Senior Manager Function. Alongside this role, we have dedicated pages for Compliance Officer (SMF16), MLRO (SMF17), Chair and Committee Chairs (SMF9–SMF14), Chief Operating Officer (SMF24) and Regulated Chief Executive (SMF1), and designation guides to every other SMF. We also run sector-specific searches for wealth managers, investment managers, consumer credit firms, insurers and MGAs, banks and building societies, payments and fintech firms and crypto-asset firms, and location searches in London, Birmingham and Bristol. Candidates can see every current role on our SMF jobs board.

Frequently Asked Questions

Does a Core firm need an SMF4?

No. SMF4 applies at Enhanced and dual-regulated firms. Core firms may still need a head of risk, and we recruit for those roles too.

Can the CRO also hold compliance oversight?

It can happen at smaller firms, but combining risk and compliance can weaken independent challenge. The regulator will want to understand how the arrangement works.

Do you provide interim CROs?

Yes. See fractional and interim SMF cover. Interim CROs can often be introduced quickly, subject to approval where required.

How long does a CRO search take?

Typically four to six weeks to shortlist, then notice periods and the regulators’ assessment. For dual-regulated roles, allow time for a PRA interview.