Four in five companies have no CRO

Just one in five UK companies employs a chief risk officer, according to research amongst 250 UK business leaders by Gallagher. Where there isn’t a CRO in place responsibility for managing risks most often falls to the CEO, despite their lack of specialist risk knowledge.

Although the majority of businesses don’t employ a risk specialist, seven in ten (70%) business leaders believe that taking calculated risks is empowering, fundamental to sustained growth, and should form an integral part of growth planning.

A similar number of (71%) businesses’ acknowledge that they need to become more agile about how they assess risk, yet the reality is that with UK companies so underweight in risk and compliance experience they lack both the skills and mind-set to assess and respond to evolving risks.

Commenting on the findings, chief risk officer at Gallagher, Carol Richmond said: “At a time when technological change, rapid digital adoption and a whole host of other risks are presenting new and complex challenges to UK businesses, many organisations don’t have the specialist knowledge to identify what these emerging risks could mean for their business and are relying on CEOs to make significant risk decisions.

"It’s not simply about identifying risks facing the business. A key part of what a risk specialist will do is identify risk issues that should be prioritised. All businesses deal with risks on a regular basis, but it’s as important to have the knowledge to understand those that can be a game changer for the business either in a positive or negative way.

“A lack of robust risk management and identification can greatly undermine the achievement of strategic goals, and with the current lack of risk management skills in many businesses, it raises questions about the capacity of some of the UK’s senior leaders to take a strategic view."

    Share Story:

YOU MIGHT ALSO LIKE


Resilience Rooted in Reality
In this podcast, CIR speaks to CLDigital’s Tejas Katwala about why organisations must move beyond checklist compliance to build living, data driven resilience. He explains how rethinking governance, risk and compliance, breaking down silos and focusing on value streams can create sustainable, real time resilience that is rooted in the way businesses actually operate today.

Building cyber resilience in a complex threat landscape
Cyber threats are evolving faster than ever. This episode explores how organisations can strengthen defences, embed resilience, and navigate regulatory and human challenges in an increasingly complex digital environment.