Thinking of becoming a chief risk officer? Here's some advice: Forget it. You don't have time for the pain.

The CRO position, created only a few years ago at a handful of companies, is in danger of becoming irrelevant outside of two or three industries, most notably insurance, energy and banking.

Certainly, the number of CRO positions isn't increasing. In fact, the opposite appears to be the case. At best, some companies are appointing de facto CROs without the benefit of the C-level designation--usually an executive who has been designated "vice president" of risk, possibly with other responsibilities attached.

What's more--and far more important--those who have the title are in danger of losing their direct reporting relationship with the CEO and their "dotted line" relationship with audit or finance committees. Instead, they're being told the CFO is their boss. In effect, it's becoming an unequal relationship between C-level appointees and the CFO is winning this battle.

AN EMASCULATED POSITION

That's making it more difficult for CROs to fulfill their mission, which many say is to assure boards that the company has a grip on all the risks it faces and that the firm has appropriate policies in place for managing them.

What's the danger? That future risks will be poorly handled? That stakeholders will get exactly the opposite of what they've been promised? That companies may be opening themselves up to Sarbanes-Oxley Act liabilities?

There's no question that the designation C-R-O--and those who hold it--are in trouble. The reasons are many: competition with the CFO, weak support from boards, poorly defined missions and tuN' battles with line managers resentful of a new third-party C-level executive.

Finally--and perhaps most lethally--the question of who is qualified to fill the position is a debate raging among corporate executives, consultants and academics following the issue.

"There are different issues trying to bring a CRO in, issues about carving out a new slot within a corporation," says Bob Anderson, executive director of the Washington, D.C.-based Committee of Chief Risk Officers and former CRO of El Paso Energy. "In theory, the CRO is the peer of the CFO, and the CRO has a 'dotted line' relationship to the audit committee. But that's not always the case."

To be effective, CROs need the ear of the audit or finance committees, Anderson says. Adds Don Mango, CRO at GE ERC: "Appointing CROs can be a little bit like putting the cart before the horse. You can have a very effective enterprisewide risk management program without a CRO. And you can have a CRO who leads an ineffective risk management program. If the person is cosmetic, that person is going to struggle."

Some executives worry that some boards may be appointing CROs simply as a highly public and visible means of fobbing off their risk management responsibilities without supporting the position after it's created. One of the more well-known CROs, Richard J. "Rick" Machold, vice president and CRO of Atlanta-based Certegy Inc., suggests as much.

"The board cannot abdicate its responsibility," says Machold. "Ideally, the CRO is a mechanism that affords the board and audit committee unfettered transparency into the risk profile of the business. But he or she may not be able to do that."

Others agree that board access is crucial, although not necessarily provided. "CROs really need a senior-level sponsor at the board level and a senior-level sponsor at the executive level. You need commitment and resources," says James Lain, president of Boston-based risk advisory firm James Lain & Associates, former CRO of Fidelity Investments and author of Enterprise Risk Management: From Incentives to Controls.

Hawkish board members and executives sin]ply believe that a CRO should never be appointed and that they may well be detrimental to the health of a publicly held corporation.

"You know who a company's chief risk officer is?" says P. Richard Hackenburg, vice president of insurance services at risk-management advisor FOJP Service Corp. in New York and a former senior executive at insurance broker Willis. "It's the chairman of the board. Someone else serving as the CRO is a bunch of hooey. At the end of the day, the office of the CRO is all irrelevancy."

"Risk management starts with the CEO. It needs to be imbued throughout the organization," says Warren Batts, retired chairman of Chicago-based Premark International and an adjunct professor at the University of Chicago's school of business.

John O. Whitney, who sits on the board of Princeton, N.J.-based Church & Dwight (maker of Arm & Hammer products), as well as other boards, says CROs just aren't worth paying for. "If you have a huge multidivisional enterprise, you might want someone who pays attention to that, but I wouldn't want to add to the overhead," he says.

Many believe that making the CRO report to the CFO kills the effectiveness of the position, particularly without the direct relationship to the board.

"I've written numerous times about the necessity of any organization having a single independent leader or coordinator for the risk process, but I'm not sure that any one title is required, says H. Felix Kloman, editor and publisher of Lyme, Conn.-based e-newsletter Risk Management Reports. "I do believe that the leader should have direct access to both the CEO and board. An individual who reports, for example, to the CFO is limited in what he or she can accomplish."

Adds Robert Hoyt, a member of the faculty at the newly-created Center for Strategic Risk Management at the University of Georgia's Terry. School of Business in Athens: "The CRO title means many different things regarding authority. If you report to the CFO, do you have the mandate? Even when you report to the CFO there has to be some level of support from management and the board."

EYEING THE CRO ROLE

Ironically, all this is happening at a time when many corporate executives across "silos" are vying to become CRO, in some cases quietly circulating media stories about CROs to their own bosses with the hope that a new job will be created that they can fill.

It's no secret that Chris Mandel, a former president of the Risk and Insurance Management Society and CRO at insurance giant USAA in San Antonio, is pushing the idea that industry executives should be positioning themselves for CRO roles.

Others are seeking the title, too--perhaps most surprisingly, actuaries, who through their professional associations are hosting conferences and forming committees about enterprise risk management and who think that, in time, they should be able to take CRO positions outside the insurance and financial services industries.

After all, they argue, not only are they good at putting together insurance-related actuarial numbers; they're experts at modeling, they say, whether it's for hurricane risk, or for how a company can predict future earnings or losses if new product introductions are delayed.

Says Barry Franklin, a consulting actuary and managing principal at Chicago-based Aon Risk Services: "If you look at what the CRO is charged with, you can make a strong case that within insurance companies, actuaries are the logical candidate to become the CRO. That's because in insurance companies, most cash flow and balance sheet items are risk related."

Then, too, there are the energy companies and financial services industry executives who think insurance risk management should fall under their purview. They point to a much broader range of risks that they handle currently as a recommendation for becoming CRO--both financial as well as physical energy risk, for example.

Laurie Brooks, vice president and CRO at Newark, N.J.-based energy holding company PSEG, thinks risk managers in her industry are the most sophisticated anywhere. "While in some industries, all the insurance risk managers do is go out and schmooze the industry," she says, "at PSEG we strive to design, develop and implement the most cost effective risk management programs."

"The PSEG insurance risk manager works closely with the business units to identify risk and then evaluates and negotiates risk transfer plans based on exposure/ cost benefit analysis," says Ken Brockman, risk management manager for PSEG. "At PSEG the hazard risk manager does more than coordinate and place insurance. The placement of insurance is only part of the process."