Designed Out of the Decision

Three structural choices that can make a capable risk function irrelevant

By Elina Moshkovich

Everything can be in place. The CRO reports to the board. The risk committee meets quarterly. The register is current, the appetite statement was approved last year, and the dashboard is green.

And the company still walks into the exposure it had been watching.

Part II ended with three structural questions: where the CRO reports, when the risk function is invited, and who is allowed to hear bad news first. The answer is blunt: irrelevance can be designed.

A risk function can be technically strong and independent on paper yet still sit too far downstream to change anything. The architecture decides that long before anybody assesses the quality of the work.

Six structural choices repeatedly produce that result, even in companies that describe their own risk management as mature. Three concern where the risk function stands. The other three concern what happens to a warning once it exists.
 

1. Independence exists on the organization chart
   Where the CRO reports matters. It is still only a proxy for access.
   A dotted line on an organization chart is not an escalation channel.
   McKinsey’s 2025 Global GRC Benchmarking Survey, covering 193 decision-makers, found that 44 percent of institutions place the head of risk more than one level below the chief executive. Those institutions report less mature risk functions, lagging on risk appetite, stress testing and risk-based compensation.¹
   The survey does not establish causation. It does show a clear association between seniority and maturity. Seniority is the part the board can see, and change.
   FERMA’s 2024 survey of 1,041 risk managers in 77 countries found no dominant model at all: 26 percent report to the CFO, 21 percent to the board, 21 percent to the CEO.²
   The reporting line tells only part of the story. If the CRO identifies a material concern today, can it reach the relevant decision-maker today, without being softened through several layers and without waiting for the next reporting cycle?
   The IAIS answered that question years ago, and in plainer language than most risk policies ever do. ICP 8 expects a system that allows reporting on risk issues within established reporting cycles and outside of them, and early warnings or triggers allowing timely consideration of and an adequate response to material risks.³
   Outside of them. Three words, and most escalation frameworks quietly ignore them.
   I have worked under both kinds of arrangement: a formal line to the board that offered little practical access, and a less direct structure with reporting line to CFO in which I could reach CEO and the board directly. The second mattered more.
2. The invitation arrives after the real decision
   The approval date is one of the most trusted dates in corporate governance. Often it is only the date the paperwork caught up with a decision made earlier.
   A decision can become difficult to reverse weeks or months earlier: when a preferred option gains a sponsor, when budget is reserved, when negotiations advance or an external date is announced.
   The proposal may still be open legally. Psychologically and commercially, it may already be closed.
   One bancassurance launch I encountered followed exactly this sequence. The bancassurance sales team had agreed the product with the bank and committed to a launch date before the product and its terms had been approved internally. The financial risk assessment came afterwards.
   Once the economics and exposures were assessed together, there was no longer a good option. Without additional limits and conditions, the proposition was not acceptable. With them, it became significantly harder to sell.
   By then, however, the commercial commitment had already been made. The limits were introduced and did what they were designed to do. The product launched, but sold almost nothing.
   The limits did not turn a viable proposition into a bad one. They exposed a problem that should have been part of the decision before the commitment was made.
   A material decision should begin with a structured view of benefits, costs and uncertainty. What has to be true for the business case to work? What happens under a less favorable scenario? Which assumptions are most fragile? How much can the economics deteriorate before the proposition stops making sense? And what options remain if those assumptions prove wrong?
   That analysis needs risk input while the alternatives are still open, not after one of them has effectively been chosen.
   It will not make the decision infallible. Forecasts can be wrong, assumptions can fail and events can unfold outside the scenarios considered. The purpose is not certainty. It is to make the decision with a fuller picture of what can go right, what can go wrong and what the company can still do about it.
   The problem in this case was not that the risk assessment blocked the business. It was that the business had committed before the full economics of the decision had been tested.
   That is the expensive version of being late. By that stage, the decision can no longer be improved. It can only be constrained.
   Experiences like this are why I have always treated timing as part of the quality of the assessment itself. For material product approvals, my teams needed at least two weeks before the formal approval date. If that time was not available, the formal record stated explicitly that the assessment was incomplete and that not all material exposures could be fully assessed.
   The timing problem is not anecdotal. In the 2025 Baker Tilly and Internal Audit Foundation survey of 567 organisations, only a quarter aligned the timing of risk assessments with the business planning cycle.⁴
   Formal access is improving. FERMA reports that 46 percent of respondents participate in board meetings, either as permanent members or invitees, and 45 percent do the same in executive committees. Two years earlier, the figures were 32 and 34 percent.²
   A place in the formal process has limited value if the material choice has already been made.
   Solvency II is explicit. Article 269 of the Delegated Regulation requires the risk-management function to advise the governing body on corporate strategy, mergers and acquisitions, and major projects and investments.⁵
   In some companies, the regulation is more decision-oriented than the process built to comply with it.
   The relevant question is about options, not attendance. When the risk function first sees a material proposal, can management still choose a materially different one?
3. Expertise in the room is not challenge in the room

The third choice is the hardest to see, because it appears on no chart.

Boards are often told that weak risk oversight requires more risk expertise around the table. Sometimes it does. Expertise matters only if it changes how a proposal is tested.

The test is simple: which assumption was challenged, by whom, and what changed as a result?

Citibank provides a documented example of governance system failing to produce timely correction. In October 2020 the Office of the Comptroller of the Currency assessed a 400-million-dollar civil penalty, describing the failures as serious and longstanding. Among the deficiencies cited were enterprise-wide risk policies that did not adequately identify, measure, monitor or control risks, compensation that did not incentivize effective risk management, and board oversight inadequate to ensure timely corrective action.⁶

The order does not tell us that the board lacked expertise. It tells us something more useful: policies, committees and reporting had not produced timely corrective action.

There are days when you wonder whether the curse changed hands. Cassandra was not believed. A board believes the paper, and notes it.

Culture becomes operational here. A board with the authority to challenge, but no operating discipline that requires assumptions to be tested, will produce exactly the documentation it asks for.

The test is simple. Take the last three material proposals to the board. For each, name the assumption that was tested, who tested it, and what changed. If the answer is that the paper was read and accepted, the expertise in the room is not doing the work everyone assumes.

A board paper can be technically complete and still leave its central assumption untested. Nothing in the formatting will tell you that.

None of these three can be fixed by another policy, another committee or a more detailed register. They are about access, timing and the obligation to ask.

A company can give its CRO independence and still give the role very little influence. It can invite the risk function to every formal approval and still invite it too late.

The architecture is present. What is missing is the connection that carries a warning into a decision while the decision can still change: a Cassandra Watch.

Part IV follows the warning into the room: who is required to act, what the bonus actually rewards, and why a page with nothing amber on it should worry a board most.

NOTES AND SOURCES
 

1. McKinsey, Global GRC Benchmarking Survey 2025, based on 193 decision-makers. Figures used here cover the position of the head of risk relative to the CEO and the areas in which less mature risk functions lag.
   https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/governance-risk-and-compliance-a-new-lens-on-best-practices
2. FERMA, Global Risk Manager Survey 2024. 1,041 respondents from 77 countries. Figures used here cover reporting lines and participation in board and executive committees.
   https://ferma.eu/publications/global-risk-manager-survey-report-2024/
3. International Association of Insurance Supervisors, ICP 8: Risk Management and Internal Controls, on reporting inside and outside established cycles and on early warnings or triggers. On the positioning, authority and board access of control functions, see also the IAIS Application Paper on Supervision of Control Functions, June 2021.
   https://www.iais.org/icp-online-tool/
4. Baker Tilly and the Internal Audit Foundation, Enhanced Enterprise Risk Management and Strategic Decision-Making, 2025. 567 respondents, surveyed January to February 2025.
   https://www.theiia.org/globalassets/site/content/research/foundation/2025/enhanced-enterprise-risk-management-and-strategic-decision-making.pdf
5. Solvency II Delegated Regulation (EU) 2015/35. Article 259 sets out the risk-management system and requires a clearly defined procedure on the decision-making process. Article 269 sets out the tasks of the risk-management function, including advice to the governing body on corporate strategy, mergers and acquisitions, and major projects and investments.
   https://www.eiopa.europa.eu/rulebook/solvency-ii-single-rulebook/article-5920_en
6. Office of the Comptroller of the Currency, consent order and 400 million dollar civil money penalty against Citibank N.A., 7 October 2020.

https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-132.html
 

ABOUT THE AUTHOR

Elina Moshkovich is Founder of Risk University, a Board Advisor and Fractional CRO, and former Chief Risk Officer at Allianz and MetLife. She has more than 15 years of experience in senior risk and governance roles across insurance, banking and consulting. She advises boards, CEOs and senior executives on risk-management effectiveness, corporate governance and decision quality, with a particular focus on embedding risk management into strategic, capital and operational decision-making. Through Risk University, she also develops executive education for insurers and financial institutions. www.RiskUni.com