The Chief Risk Officer: The Line Past the Chief Executive
The chief risk officer is the one Gulf executive designed to reach the board directly, and the seat is only worth what the chairman will tolerate hearing.
The chief risk officer is, on paper, the only senior executive at most Gulf listed platforms and larger group holdings with a governance-designed line to the board that does not run through the chief executive, and that single structural feature is what makes the seat both the most important independence mechanism most boards have and, in JOH Partners' reading of governance practice across its own mandates, the one most quietly hollowed out once the appointment is actually made. This piece sets out why the chief risk officer's direct line to the board is worth only what the chairman is prepared to protect, and what a board should do to keep the channel genuinely open rather than nominally so.
Why the chief risk officer seat is different by design
Governance codes across the Gulf increasingly require listed platforms to maintain a board risk committee and a chief risk officer function with a defined reporting relationship to it, a structural expectation distinct from most other senior seats, which report to the chief executive and reach the board, if at all, only through that single channel. The design intent is straightforward: risk oversight that depends entirely on the chief executive's willingness to escalate concerns about the chief executive's own decisions is not independent oversight, so the chief risk officer is meant to carry a channel that survives that specific conflict of interest.
The gap between that design intent and how the seat actually functions is where JOH's own reading of the market diverges from the governance code's assumption. A direct line to the board risk committee is a structural feature written into a charter; whether it is used, and used without cost to the person using it, depends almost entirely on whether the chairman visibly protects the channel in practice. A chairman who treats an unscheduled approach from the chief risk officer as a legitimate part of the role's function makes the channel real. A chairman who quietly signals, through tone or through what happens next, that such approaches are unwelcome makes the channel exist only on the page it is written on.
The risk committee charter says the chief risk officer can reach the board directly. What actually determines whether that happens is not the charter. It is what the chairman does the first time it is tested.
What separates a genuine independence channel from a nominal one
What a chief risk officer's charter typically promises, and what determines whether it is real
| Charter provision | What makes it real in practice |
|---|---|
| Direct or dotted-line access to the board risk committee | Whether the chairman visibly protects unscheduled approaches, rather than treating them as a breach of process |
| Right to raise concerns without chief executive pre-approval | Whether that right has actually been used, and what happened to the relationship afterward |
| Risk appetite set and reviewed at board level | Whether the review is a substantive discussion or a pre-agreed document ratified without challenge |
| Chief risk officer performance and remuneration set independently of the chief executive | Whether the person who sets the chief risk officer's pay is the same person the role may need to challenge |
The last row of that table is, in JOH's experience, the most commonly overlooked structural weakness. A chief risk officer whose remuneration and continued tenure are effectively controlled by the chief executive, even where a board committee formally signs off, carries a quiet incentive to use the direct line to the board sparingly. Boards that genuinely want the channel to function put the chief risk officer's remuneration and performance review process at meaningful arm's length from the chief executive's direct influence, mirroring the independence protections most governance codes already require for the external auditor relationship.
The interview question boards rarely ask, and should
Most chief risk officer appointment processes test technical risk competence thoroughly: quantitative modelling, regulatory fluency, sector-specific risk exposure, prior seniority. What they test far less reliably is the one capability the seat actually exists to provide: the willingness to escalate a genuine concern past a chief executive, and the composure to remain effective afterward rather than being quietly sidelined or choosing silence the next time. JOH's work on the chief legal officer seat documents a structurally similar independence test for a different function; the chief risk officer version differs in one important respect, because the seat's line to the board is meant to be more procedurally protected than the chief legal officer's, which makes it more consequential when the protection turns out to be nominal rather than real.
1,000+. Senior mandates JOH Partners has closed across the Gulf, the UK and Singapore since 2014
92%. JOH's tracked 24-month retention rate across placed senior executives
The most reliable version of the independence test JOH has seen run in practice asks a candidate to describe a specific instance of escalating a risk concern past a line manager or chief executive, what mechanism they used, and what happened to both the concern and their own standing afterward. A strong answer is concrete and includes an honest account of relationship cost, not just a clean resolution. A weak answer stays hypothetical, or names an instance where the concern was quietly absorbed and never actually reached the level it was meant to.
Why boards should watch the escalation pattern, not just the charter
A board that wants to know whether its chief risk officer's independence is genuine should look past the charter and track the pattern of actual use: how often the risk committee hears directly from the chief risk officer without the content having passed through the chief executive first, and whether at least one substantive disagreement between the risk function and executive management has reached the board in a defined recent period. JOH's research into chairs at Gulf-listed family businesses found a related pattern one level up the governance chain: boards that document independence protections but never actually test them tend to discover the gap only once a real conflict forces the question into the open, at which point the cost of the gap is far higher than the cost of building the protection properly from the start. The same discipline extends into how boards are learning to oversee model and AI-driven risk specifically, an area JOH's boardroom AI governance research found most Gulf boards are not yet well equipped to challenge on technical grounds, which makes the chief risk officer's independent voice even more consequential precisely where board technical literacy is currently weakest.
Boards seeking ongoing visibility into how the risk function and the wider executive layer are actually behaving between formal committee cycles increasingly use platforms such as Board Pulse to track governance signals continuously rather than waiting for the risk committee's next scheduled meeting to find out whether the escalation channel is being used. David Daly's account of finance transformation, tax compliance and radical honesty inside a UAE business turnaround touches the same underlying discipline from a different seat: a genuinely functioning line of financial and risk honesty to the top of an organisation has to survive contact with a difficult conversation, not just exist as a stated value.
Why succession planning for the seat itself is often neglected
Boards that do build a genuinely independent chief risk officer function often make a second, quieter mistake: treating the appointment as a one-time governance fix rather than a seat that needs its own succession discipline. A chief risk officer who has spent several years building the trust and standing that make the escalation channel usable leaves a genuine independence gap behind on departure, because the successor inherits the charter's formal protections without the informal credibility that took years to establish. Boards that plan for this transition, identifying and developing an internal deputy with the same composure profile, or building a deliberately longer handover period than they would for a purely technical seat, protect the channel's real function rather than only its paper description. Boards that treat the seat as interchangeable once filled tend to discover, at the point of transition, that the independence they thought was structural was in fact personal, and it can take a new appointee a full cycle to rebuild the standing their predecessor had earned.
What a board can do to keep the channel genuinely open
Four practices separate a board whose chief risk officer's independence is real from one whose independence exists only in the charter. The first is the chairman actively protecting unscheduled approaches from the chief risk officer, treating them as the function working as designed rather than as a process breach. The second is setting the chief risk officer's remuneration and tenure review at genuine arm's length from the chief executive's direct control. The third is building the escalation interview question into the appointment process itself, so the independence test happens before the hire rather than being discovered afterward. The fourth is tracking the actual pattern of board-level escalation over time, the way JOH's engagement building group functional leadership at a Tadawul-listed Saudi industrial holding treated governance-facing functional roles as appointments that needed structural protection written in from the outset, not negotiated informally once the team was in place.
A board that does all four has built a risk function whose independence will hold when it is actually tested. A board that has only written the charter has built something that looks identical on paper and functions very differently the first time a real disagreement arrives.
Key takeaways
JOH Partners is an executive search and senior executive recruitment firm advising boards, family groups and sovereign-adjacent platforms on chief risk officer, governance and board-committee appointments across the GCC, the UK and Singapore. Boards wanting continuous visibility of governance and risk-function independence can request a Board Pulse demo, or engage a partner for a confidential conversation about the chief risk officer seat and its reporting structure.
Questions about this topic.
What makes the chief risk officer role different from other C-suite seats?
Most senior executives report to the chief executive and reach the board, if at all, through that reporting line. The chief risk officer is typically designed with a direct or dotted-line channel to the board's risk committee that exists independently of the chief executive's approval, a structural feature few other seats carry in the same explicit form.
Does a chief risk officer actually use their direct line to the board in practice?
Formally, in most governance codes and charters, yes. In JOH Partners' reading of governance practice across its mandates, the line is used far less often than it exists on paper, because using it carries a real relationship cost with the chief executive, and a chief risk officer without a chairman who visibly protects that channel will use it sparingly regardless of what the charter says.
How should a board test a chief risk officer candidate's independence at interview?
By asking for a specific, concrete instance of the candidate escalating a concern past a chief executive or line manager, including what happened afterward to the relationship and to the candidate's own position. A candidate who cannot produce a real example, or whose example ends with the concern being quietly dropped, has not demonstrated the independence the seat is designed to provide.
What is the difference between a chief risk officer and an internal audit function?
Internal audit typically tests whether existing controls and processes are being followed correctly, looking backward at compliance with what already exists. A chief risk officer typically owns the forward-looking view: identifying and pricing risks the organisation has not yet built controls for, and advising the board on risk appetite before a control failure occurs rather than after.
How can a board know whether its chief risk officer's independence is genuine rather than nominal?
By reviewing, at board level and on a defined cycle, how often the risk committee actually hears from the chief risk officer without the chief executive present or without prior chief executive sign-off on the content, and whether at least one substantive disagreement between the risk function and executive management has reached the board directly in the past two years. A board that cannot recall an instance should treat that as a governance signal worth investigating, not a sign that all is well.
Oliver Helvin
Founder and Managing Director
Oliver Helvin is the Founder and Managing Director of JOH Partners. He writes on the GCC executive market, leadership transitions in family-controlled businesses, and the discipline of senior search.
LinkedIn ↗
A standing brief on the executive market.
New research, perspectives and market notes — direct to inbox. Read by chairs, chief executives and investors across three regions.
Tell us about the seat.
We’ll tell you who’s right.
Confidential conversations with the partner leading the practice you need. We respond within one business day.