A chief risk officer's responsibilities in an asset manager are to set and police the firm's risk limits, run an independent view of every portfolio's market, liquidity, counterparty and valuation risks, escalate what breaches to portfolio managers, the board and regulators, and make sure the reports the board relies on are true. US fund rules do not require anyone to hold the title; the rules hand duties to roles, such as the derivatives risk manager under Rule 18f-4 or the EU's permanent risk management function, and the CRO usually holds or supervises several of them. Stress testing is where the job is most visible, because one scenario passes through five seats before it reaches the committee. Botminds' Stress Testing and Scenario Analysis is built around those seats: agents draft, challenge, run and explain, and each person sees only the decisions that are theirs.
The seats below are drawn from the solution's fictional sample firm, Quillfield Capital, whose CRO approves every scenario, decides breaches and signs the committee papers. The rules and cases are real.
Five seats in the CRO's stress program, before and with agents
Today
Reads central bank texts, often through browser translation, sets shocks by hand in the engine's scenario editor and argues each size by email for weeks.
With agents
Starts from a cited draft, answers the challenge to each shock on the record and submits a scenario with its argument attached.
Still theirs: The judgement on every shock, and the reason when keeping one against the challenge. Never approves.
Today
Runs a subset of funds overnight, on positions that may be stale and private marks a quarter old, and reruns by hand when a batch fails.
With agents
Reviews a run the agents executed in full: positions reconciled, batches retried, exceptions held with a proposed fix.
Still theirs: Applying or rejecting each fix before held results are released.
Today
Collects weekly stress and backtest results from several systems and writes the board report from pasted numbers.
With agents
Reads weekly results for the funds using derivatives, drawn from the same signed runs as the committee papers.
Still theirs: The Rule 18f-4 judgements and the direct line to the board. Board approval of the designation.
Today
Hears of a breach by email, with no named driver and no deadline for the answer.
With agents
Sees only their own funds, the positions behind each loss and a two-business-day clock; tries an illustrative what-if.
Still theirs: The trade, and the answer to every breach. Never decides a breach on their own fund.
Today
Reads numbers pasted into slides weeks after the run, with no way to see where they came from.
With agents
Opens any figure in the paper to its run, scenario version and date, and asks a question before the meeting.
Still theirs: Approval of limits, with the CRO, and the challenge the committee exists to make.
What are the responsibilities of a chief risk officer in an asset manager?
They fall into five duties. First, the risk framework: limits for every portfolio, approved by the board or its committee, and a policy for what happens when one is crossed. Second, independent measurement: market, liquidity, counterparty and valuation risk measured by people who do not run the money. Third, the scenario set: which events the firm tests, how often and how severely. Fourth, escalation: breaches to the portfolio manager with a clock, material risks to the board without delay, and the regulatory filings some breaches require. Fifth, the record: reports the board can rely on and evidence an examiner can reproduce.
The EU rules write most of that list into law for the function rather than the person. Under the AIFMD's Level 2 regulation, the permanent risk management function must implement risk policies to "identify, measure, manage and monitor on an ongoing basis all risks relevant to each AIF's investment strategy," monitor compliance with risk limits, notify the governing body when a fund's risk profile is inconsistent with them, and give senior management regular updates on "any actual or foreseeable breaches of any risk limits" (Delegated Regulation 231/2013, Art. 39). The UCITS rules say the same for management companies, adding advice to the board on each fund's risk profile (Directive 2010/43/EU, Art. 12).
Who owns which risk duty in a fund firm, by rule
| Duty | US funds | EU funds | Where the CRO usually sits |
|---|---|---|---|
| Independent risk function | No rule requires a CRO title for fund advisers | A permanent risk management function, hierarchically and functionally independent of operating units (UCITS); functionally and hierarchically separate from portfolio management (AIFMD) | Heads it |
| Derivatives risk | A derivatives risk manager: an officer of the adviser, not a portfolio manager of the fund, with relevant experience; designation approved by the board (Rule 18f-4) | Global exposure and VaR limits monitored by the risk function (UCITS) | Often is the derivatives risk manager, or supervises them |
| Stress testing | At least weekly for funds with a derivatives program (Rule 18f-4); board-set intervals for money market funds (Rule 2a-7) | Monthly at least for VaR UCITS (CESR); periodic stress tests and scenario analyses for AIFs (AIFMD Art. 45) | Owns the scenario set and the approvals |
| Reporting to the board | Derivatives risk manager reports stress, backtest and exceedance results at a frequency the board sets | Regular reports to the board on risk levels against the agreed profile and on limit compliance | Signs the risk sections of the board and committee papers |
Who does a chief risk officer report to?
In a fund firm, to the chief executive or equivalent for management purposes, with a line to the board, or a board committee, that cannot be blocked. The EU rules are specific about independence. The AIFMD's Level 2 regulation treats the risk function as separate from portfolio management only where four conditions are all met, the first of which is this:
Persons engaged in the performance of the risk management function are not supervised by those responsible for the performance of the operating units, including the portfolio management function, of the AIFM.
Commission Delegated Regulation (EU) No 231/2013, Article 42(1)(a)
The others require that risk staff do not perform portfolio management, are paid against the risk function's own objectives "independently of the performance of the operating units," and that the pay of senior risk officers is overseen by the remuneration committee where one exists, with the separation ensured "throughout the whole hierarchical structure of the AIFM, up to its governing body" (Art. 42). The UCITS rules require the function to be "hierarchically and functionally independent from operating units," with a proportionality derogation the firm must be able to justify (Directive 2010/43/EU, Art. 12(2)).
US fund rules reach the same place through specific roles. Rule 18f-4 lets the derivatives risk manager inform the board directly of material risks, requires a written report to the board on stress tests, backtests and exceedances at a frequency the board sets, and requires board approval, including a majority of independent directors, of who holds the role (17 CFR 270.18f-4(c)(1)(v), (c)(3)).
Is the chief risk officer the derivatives risk manager?
Often, and the combination is allowed as long as the person is not also a portfolio manager of the fund. It concentrates two duties that can pull apart: the CRO's daily pressure on portfolio managers, and the derivatives risk manager's duty to tell the board. The SEC's settled order against Simplify Asset Management in July 2026 shows the gap. The firm's chief risk officer, who was also the fund's derivatives risk manager, told the portfolio manager on 26 April 2024 that the fund's VaR was about 253% of its reference portfolio and urged a reduction daily; the board was not told of either breach of the 200% limit until 8 August 2024 (SEC order IC-36269). Internal escalation worked; escalation to the board did not.
The lesson for the CRO's design of the job is to make the two escalation paths independent of each other. A breach should open a case with a clock for the portfolio manager and, separately, a board notification rule that does not wait for the case to close. How the derivatives risk manager's own seat works is covered in the derivatives risk manager's seat.
Five seats, five clocks: why a CRO designs timing, not just limits
Every seat in the stress program runs on a different clock, and most failures happen where two clocks meet. The analyst's clock is the scenario's approval; risk operations' clock is the weekly run; the portfolio manager's clock is the breach response; the derivatives risk manager's clocks are set by Rule 18f-4; the committee's clock is its meeting calendar. A CRO who sets limits but not clocks leaves breaches waiting in someone's inbox.
One breach in the sample firm, on three people's clocks
- Answer the breach2 d
- Wait for the answer2 d
- Decide with a reason code5 d
- Only if still unresolved10 d
The sample firm's settings also fix the tolerances: a warning at 90% of a limit, a breach at 100%, and a ceiling of 102% on what the CRO may accept within tolerance. Above that, the CRO cannot wave a breach through, and in the sample's open case, a fund at 108% of its limit, the "accept within tolerance" option is simply not available.
What a CRO must never hold at the same time
Roles that check each other. The SEC's 2022 complaint against Infinity Q's former senior officer describes a single person who was "the former Chief Risk Officer, head of operations, and Chief Compliance Officer, and a former portfolio manager and Valuation Committee member," and alleges that he negligently told investors and the fund's board that a pricing service was "independent" of the adviser when the founder controlled it (SEC Litigation Release 25542). These are allegations in a complaint, not findings. But the list of titles is the point: when the person who checks the risk also helps take it and value it, no one is checking.
Stress Testing and Scenario Analysis: segregation of duties as settings, not a memo
Key issues for a chief risk officer in 2026
Leverage, data deadlines and the tools the firm itself is adopting. The Federal Reserve reported in May 2026 that "leverage for hedge funds remained stable at record-high levels over the period for which comprehensive data have been collected, as a decrease in the cash-futures basis trade was largely offset by other relative value trades, such as swap spread trades" (Federal Reserve, Financial Stability Report, May 2026). A CRO whose funds trade with or alongside leveraged relative-value players needs scenarios in which those trades unwind.
Reporting deadlines move the data work: the amended Form PF, with its revised market factor questions for large hedge fund advisers, applies from 1 July 2027 after a further extension published on 3 September 2026 (91 FR 56593). And the SEC's examiners have said they will look at how firms use new technology: their fiscal 2027 priorities describe registrants bringing what the SEC calls "super intelligence (SI)" into advisory and portfolio management work and into compliance monitoring (SEC Division of Examinations, FY2027 priorities). A CRO adopting agents in the risk function should be able to show which decisions they never take; AI-assisted scenario analysis looks at one such agent in detail.
Chief risk officer job description: what to write into it
Write the duties as decisions with owners and clocks, not as areas of interest. A job description that says "oversees market risk" cannot be tested; one that says "approves or returns every new scenario within a day of submission, with a reason code" can.
A chief risk officer job description for a fund firm, written as decisions
- Approves every scenario that enters the official set
With a reason code, and never one they drafted. Re-approves each official scenario on a fixed cycle.
- Decides every stress limit breach within a set clock
After the portfolio manager has answered; escalates to the committee what remains open.
- Proposes limits; co-approves changes with the committee chair
No single person can move a limit after seeing the result it would cure.
- Owns the line to the board
Including any board notification rules that run independently of internal breach cases.
- Signs the risk sections of the committee and board papers
From signed runs only, with every figure traceable to its run, scenario version and date.
- Holds no portfolio management or valuation vote
And reports to someone other than the heads of the operating units the function checks.
- Approves the tools and models the risk function uses, and their limits
Including agents: which tasks they perform, which decisions they may never take.
Where Stress Testing and Scenario Analysis fits in the CRO's office
The solution gives the CRO one screen for the stress program: the weekly run's results, the portfolios over a limit, what waits for a decision and the next committee date, with the agents' overnight work beside it. Each decision opens with its evidence and closes with a reason code. Each seat sees what is theirs: the analyst drafts and cannot approve, the portfolio manager sees only their funds, internal audit reads everything and changes nothing.
The CRO's morning: what broke, why, and what waits for a decision
What the solution does not do is take the CRO's decisions. The agents never make a scenario official, never close a breach, never recommend a trade and never send the committee papers. That boundary is the point: the CRO's responsibilities stay with a person who can be held to them.
Questions people ask
What does a chief risk officer do at an asset manager?
Sets and polices risk limits, runs an independent view of market, liquidity, counterparty and valuation risk, owns the stress scenario set, escalates breaches to portfolio managers and the board, and signs the risk sections of board papers. In the EU much of this is the legal duty of the permanent risk management function the CRO usually heads.
Do US fund advisers have to appoint a chief risk officer?
No US fund rule requires the title. Rule 18f-4 requires a derivatives risk manager for funds above its limited-user threshold, and Rule 22e-4 a liquidity program administrator; a CRO often fills or supervises those roles. Registered advisers do have to designate a chief compliance officer under Rule 206(4)-7, which is a different job.
Can the chief risk officer also be a portfolio manager?
Not for a fund where the CRO is the derivatives risk manager: Rule 18f-4 bars the derivatives risk manager from being a portfolio manager of the fund. The EU rules require the risk function to be separate from portfolio management, and the Infinity Q complaint shows the risk of one person holding risk, compliance, operations and valuation roles at once.
What is the difference between a chief risk officer and a chief compliance officer?
The compliance officer administers policies designed to prevent violations of the securities laws; the risk officer measures and limits the risks the firm takes within them. A stress limit breach is a risk matter first; it becomes a compliance matter when a rule, such as Rule 18f-4's board reporting, attaches to it.
What reports does a chief risk officer give the board?
Typically a periodic risk report against appetite and limits, the stress testing results and breaches, and any material risk as it arises. Under Rule 18f-4 the derivatives risk manager must also report stress test, backtest and exceedance results at a frequency the board sets, with what the board needs to evaluate them.