Not long ago, the brief for a senior risk leader more or less wrote itself. Strong technical grounding, a track record of building frameworks, credibility with the regulator and a steady hand on the risk register. Those things are, of course, still important. But when we sit down with chairs and chief executives to scope a search today, they spend surprisingly little time on them.
The conversation goes in a different direction, nowadays. Boards want to know whether the candidate can explain a complex exposure in three minutes to a committee that has twenty other items on the agenda. They want to know whether this person will challenge the executive team when it is uncomfortable, and whether that challenge will land as help rather than obstruction. The technical capability is assumed, and not the reason someone gets the job.
From framework builder to decision partner
The first generation of enterprise risk leaders, in many organisations, were builders. Their job was to put structure where there had been none: a taxonomy, an appetite statement, a register, a reporting cycle. That work was essential, and in most mature organisations it has largely been done.
However, nowadays, a well-maintained framework that does not change a single decision is viewed as an expensive piece of documentation. The risk leaders who are most in demand are the ones who can take that machinery and use it to shape strategy, pricing, investment and the pace at which the business takes on new things.
Industry research points the same way. Teneo's 2026 survey of UK financial services CROs describes risk functions moving "beyond frameworks toward execution", with the emphasis on accountability, judgement and decision-focused risk management. That matches what we hear in briefing meetings almost word for word.
Why the brief is changing now
Several pressures have arrived at once. The most immediate in the UK is Provision 29 of the revised Corporate Governance Code, which applies to accounting periods beginning on or after 1 January 2026. Boards of companies applying the Code must now explain how their risk and control framework is monitored and reviewed, declare how effective their material controls are, and disclose material control failings along with what is being done about them. For the first time, many directors are putting their names to a statement about controls they may not fully understand. Unsurprisingly, they want someone beside them who can give them confidence, not just comfort.
Alongside that, the risk landscape itself has become more connected and harder to model. Cyber, AI adoption, third-party dependencies and geopolitical shocks rarely behave as neat, separate line items. A risk leader who can only speak in the language of individual risk scores struggles when the real question is how three of them interact.
What boards are actually asking for
Across the searches we run in this space, the same handful of qualities keep surfacing, and few of them appear in a traditional job specification.
**Commercial judgement.** The ability to understand how the business makes money, and to frame risk in terms of what it costs or enables. Boards are wary of risk functions that only ever say no, and equally wary of those that never do.
**Clarity under pressure.** Board time is scarce. The candidates who impress are those who can strip a topic back to the decision that needs making and the trade-offs involved, without hiding behind a fifty-page pack.
**Independence with influence.** This is the hardest balance. Boards want a risk leader who will hold the line with the executive when it matters, yet who has the relationships to be invited into conversations early rather than consulted once the decision is made.
**Breadth beyond financial risk.** Operational resilience, technology and AI, conduct and culture are now firmly on the CRO's desk. Few candidates are expert in all of them. The strongest are curious enough to ask the right questions and secure enough to bring in specialists.
**Credibility with people outside risk.** Increasingly, chairs ask us how a candidate is regarded by commercial colleagues, not just by audit committees and regulators.
The profiles that tend to struggle
It is worth being candid about where good candidates fall short. In our experience, the most common gap is not technical. It is the risk professional with an outstanding framework pedigree who has always operated one step removed from the business, and who finds it hard to step into the room where trade-offs are actually being made.
The opposite profile carries its own risk. A highly commercial operator without genuine grounding in risk can win over an interview panel and then lose the confidence of the regulator or audit committee within a year. Boards are, rightly, wary of trading one weakness for another.
What it means if you are hiring
A few practical points follow. First, write the brief around the decisions you want this person to influence, not just the frameworks you want them to own. It changes who applies and how they present themselves. Second, assess for judgement directly. Case discussions built around real dilemmas from your own business tell you far more than a walk through a candidate's CV. Third, expect the strongest people to be in post and not looking. Senior risk leaders who combine depth with commercial credibility are scarce, and reaching them usually means going to them rather than waiting for them to apply.
Finally, be honest about the reporting line and the seat at the table. Candidates of this calibre ask early whether they will have direct access to the board and the audit or risk committee chair. A role that promises strategic influence but sits two levels below the executive committee will struggle to attract them.
What it means if you are in the profession
For risk professionals planning their next step, the message is encouraging, but it comes with a challenge. Technical excellence will get you considered. What gets you appointed is evidence that you have changed a decision, shaped a strategy or helped a board through something difficult. If your experience is concentrated in building and maintaining frameworks, look for opportunities to sit closer to the business: in strategic planning, in major investment decisions, or alongside the commercial teams who live with the consequences of risk choices every day.
