Corporate Governance for Banks in Southeast Europe: Policy - IFC

strategy. When the executive body or the management body considers it necessary, the CRO should also
report directly to the management body or, where appropriate, to the audit committee (or equivalent).” 52
Background Box 4: CROs in SEE Banks
In Albania, Croatia, Montenegro, and Serbia, there are no regulatory requirements for the appointment of a
CRO, but responses to the survey undertaken in 2010–2011 indicate that the presence of a chief risk officer is
usually monitored as part of the supervisory process.
In Bosnia, FYR Macedonia, and Romania, the appointment of a CRO is required. In Bulgaria, in compliance
with the legal provisions of Article 73(3) LCI, the Bulgarian National Bank has issued binding guidelines for the
appointment of CROs. It is included as part of the onsite inspection performed by supervisors.
In Romania, banking regulation requires the establishment of an independent risk function overseen by a
CRO. The legal and regulatory frameworks on risk governance as well as supervisory practice seem to foster a
strong risk culture within the banks. In compliance with Regulation 18/2009, banks reviewed have established
a risk function that operates independently under the oversight of a chief risk officer. The independence of
the risk function is underpinned by direct reporting lines of local chief risk officers to the heads of the group
risk function.
Source: EBRD, Corporate Governance Assessment of Banks (2010–2011).
In SEE, smaller local banks might not have sufficient resources for a dedicated CRO. Banks may find it more
practicable to assign these functions to another officer of the bank. The Committee of European Banking
Supervisors (now European Banking Authority) suggests that “when the institution’s characteristics—in
particular its size, organization, and the nature of its activities—do not justify entrusting such responsibility
to a specially appointed person, the person responsible for internal control can be made responsible for risk
management as well.” 53 However, best practice also suggests that the responsibilities of the CRO not be
shared with other operational functions within the bank, such as the chief financial officer or other senior
management, to avoid clear conflicts of interest and to preserve the CRO’s independence.
In subsidiaries of foreign banks, CROs and the risk management function are sometimes provided by the
home office. This solution should be carefully assessed and be subject to the regulator’s approval. 54 Data on
practices in SEE suggest that the great majority of SEE banks follow best practices in providing the CRO with
direct access to the board (see Chart 4). Of greater concern may be that only 50 percent of regulators report
regular contact with bank risk departments, when such contact is considered to be good practice. 55
52 Committee of European Banking Supervisors, High Level Principles for Risk Management (2010), paragraph 21, p. 4.
Further, the European Parliament’s Report on Corporate Governance in Financial Institutions (2011) takes the view that “chief risk officers should have
the same status in a financial institution as the chief financial officer and should be able to report directly to the board,” paragraph 14, p. 14. In
addition, the report underlines that “the CRO should have direct access to the board of the company; in order to ensure his independence and
objectivity is not compromised, his appointment and dismissal will be decided by the whole board,” paragraph 22, p. 5. In all of these cases it is clear
that the CRO needs to be able to act with independence: paragraph 14, pp. 14–21. Further discussion of the importance of the independence of the
CRO and the impact that lack of skills and independence had on the financial crisis can be found in Section 3.1.1, pp. 18–19, and Section 3.2.2, p. 21,
and in the example on p. 22.
53 Committee of European Banking Supervisors, High Level Principles for Risk Management (2010), paragraph 20, p. 4.
54 2010 BIS Principles recommends that the board and management of a subsidiary remain responsible for effective risk management processes at the
subsidiary. Although parent companies should conduct strategic, groupwide risk management and prescribe corporate risk policies, subsidiary
management and boards should have appropriate input into their local or regional adoption and to assessments of local risks.
55 EBRD, Corporate Governance Assessment of Banks (2010–2011).
Corporate Governance for Banks in Southeast Europe Policy Brief 37