When it is appropriate for a chief risk officer (CRO) or an equivalent senior risk executive to be in place, both the board of directors and management – not to mention the company’s shareholders – have a stake in that executive’s success. Organizations should assess whether the executive, as well as risk management in general, is positioned to be successful in the organization.