The initials CRO in an organization usually stand for Chief Risk Officer, but there is both a real danger, as well as a missed opportunity, if by default or laziness the letters wind up unintentionally defacto becoming the Chief Routine Officer.
Risk is never constant, and thus risk management should also not be constant. Risks evolve and paradigm shifts occur. Do we need a better example of evolving risks and paradigm shifts than COVID?! The problem arises when risk management gets complacent and gets into a routine. When the CRO stands for Chief Routine Officer then the organization is in danger of being struck with disaster and with missing out on opportunities.
The “known knowns” as Donald Rumsfeld so famously put it, will always be the easier risks to manage. If your organization operates in such a boring and unchanging environment, then all may be well with a Chief Routine Officer. Habits, processes and routines can be effective in such situations. However, it is our opinion that few organizations, even nonprofit organizations, operate in such a stale environment.
It is when the “unknown unknowns” are in effect that the Chief Risk Officer becomes a valuable asset while the Chief Routine Officer becomes a liability. In such situations a risk management team needs to be creative, flexible, forward looking, and proactive. Routines generally do not help, and indeed may be harmful when the landscape shifts.
Crisis, paradigm shifts, evolving landscapes are all events that create winners and losers. The difference between the winners and the losers in such situations is based on the organizations that can adapt, be flexible and shift the probabilities of upside risk and downside risk to their favor. That of course is the task of the Chief Risk Officer. The Chief Routine Officer meanwhile will be lost in the fog of routine on a path that is no longer helpful or relevant.
