Risk Matters: What I'd Tell Myself on Day One

By John Stewart, SERC Director and Executive-in-Residence

I retired this spring after 30 years in banking, the last 15 as a Chief Risk Officer. If I could hand my Day-One self a short note, it would come down to three things.

1. Get your team to understand the business as well as the business understands itself. 
2. Build your relationships with regulators before you need them, and
3. Quit doing what no longer works.

Start with the Business Objectives

Every risk function claims it’s aligned with strategy. In practice, that often means someone held an alignment meeting, and someone else produced a slide mapping risks to objectives. That’s documentation. It isn’t understanding.

What you actually want is for Risk and the business to share the same detailed picture of where the business is headed. What are the volume growth targets, and why those numbers? What is the technology team prioritizing in cyber engineering? Which new products and markets are on the table, what trade-offs is leadership willing to live with, and what does success look like three years out? When both sides work from the same picture, alignment mostly takes care of itself. Risk can help make business ideas better, and the business can help shape how risks get mitigated. The risk appetite discussion stops being about whether to go and becomes a discussion about how to get there.

Many of us in Risk learned the hard way, through challenge. The business proposes something, Risk pushes back, and after a few rounds, everyone finally sees the objective. Effective challenge matters, and I’d never argue otherwise. But as the primary way to figure out what the business wants, it’s slow. It burns time and goodwill on questions that should have been settled at the start, and over the years it wears on the relationships a risk function can’t do without.

The gap can sit on either side of the table. Sometimes the business hasn’t defined its objectives clearly enough for anyone to understand them, much less support them. The goals are aspirational, or they keep moving, or they live in the heads of two or three senior leaders. Other times the objectives are perfectly clear, and Risk simply doesn’t have the capacity or the business knowledge to absorb them. Pointing fingers at the other side gets you friction fast. Figure out which kind of gap you have first, then go after the real problem.

Good intentions don’t scale

A CRO can have great relationships with a handful of business heads, but those won’t carry dozens of risk professionals spread across many teams, and they rarely survive turnover anyway. Shared understanding that lasts needs a process that pulls teams together. Business leaders lay out their objectives and priorities on a regular cadence and in a consistent format. Risk partners play back what they heard and raise open questions. The whole thing gets refreshed when strategy shifts, and someone on each side owns it. A process like that also shows you where you’re thin on capability or capacity, which you can then address with training, hiring, or rotating people between Risk and the business.

If I were starting over, I’d put that process in place first, and I’d sit down with business leaders before they wrote their plans, not after. Challenge does its best work when it sharpens a goal everyone already shares. It shouldn’t be the only way to get to one.

Build Regulatory Relationships Before You Need Them

In banking, as in any heavily regulated industry, your relationship with regulators underpins almost everything else. An institution that has earned its examiners’ confidence has room to grow, try new things, and work through problems as they arise. One that has lost that confidence can spend years rebuilding it. I know, because I lived it. In my first CRO role, I inherited a regulatory relationship that had gone sour, and it took years to repair. The cost was enormous. New initiatives stalled because regulators didn’t trust us, and business results suffered.

You build that confidence in the quiet stretches, not in the middle of an exam or after a problem surfaces. Starting over, I’d make regular contact with our supervisors a priority from the first month. I’d walk them through the strategy, explain how we think about our risks, and raise concerns before they find them on their own. Openness and consistency pay off over time. Sooner or later, you’ll have a hard conversation with your regulators, and when you do, a record of candor is the most valuable thing a CRO can bring into the room.

This ties back to the first lesson. A risk function that truly understands the business can explain it credibly to regulators, and that’s what helps supervisors view management’s plans as well thought out rather than merely ambitious.

Stop Rolling Forward What No Longer Works

What would I do less of? I’d stop carrying forward risk identification tools, mitigation trackers and reports just because they existed last year. Every risk function piles these up. Some worked well once but have since been overtaken by changes in the business, technology, or the threat environment. 

Others, to be honest, never worked at all. They hang around for a few reasons. Retiring them feels riskier than keeping them. The team that produces the report has grown attached to it. It might still be useful in a narrow situation. And nobody is ever asked to prove it’s worth the effort.

That has a real cost. Outdated tools eat analyst time, clutter board and committee agendas, and create a false sense that everything is covered. Worse, they pull attention from emerging risks that don’t fit the old templates.

I’d build in a regular, explicit review. For every major report or tool, ask: Who uses it? What decision does it inform? What would happen if it went away? If nobody can answer, redesign it or retire it. Deciding “we don’t need this anymore” is a risk-management decision and usually a healthy one.

The Common Thread

What ties these together is that risk management works best when it rests on relationships and understanding, not sheer process volume. A risk function earns its seat by knowing the business deeply, earning its supervisors' trust, and spending its limited time on work that actually informs decisions.

So, to anyone stepping into the CRO role today: understand the objectives before you challenge them, get to know your regulators early, and have the nerve to stop doing what no longer serves the institution. It took me years to learn these. I hope it takes you less time.

John Stewart (PhD) is the Director and Executive-in-Residence at the Smith Enterprise Risk Consortium. Stewart brings nearly three decades of financial-services experience, including more than 20 years in executive leadership. A former consultant with a Ph.D. in mechanical and aerospace engineering, Stewart combines technical modeling expertise with practical executive judgment. He has also helped shape SERC since its 2023 launch as an original Advisory Council member, Risk Circle Leader and active participant in its executive, professional-development and student initiatives.