While the crises roiling the economy and financial markets maybe taking most organizations into uncharted territory, riskmanagers eager for advancement know exactly where they want togo–up to the vaunted “C-Suite.” But to make the leap and become achief risk officer, they must pave the way by boosting theirknow-how and capabilities while alerting senior management they'reready to handle wider responsibilities, top players suggest.

Those aspiring to the position of chief risk officer haveseveral avenues to make the climb up the corporate ladder–includingcreating a role from within their current organization, or seekingemployment elsewhere as a full-fledged CRO.

But whatever entry plan they pursue, top risk managers agreethat candidates need to step out of the narrow role of insurancebuyer and gain a broader profile. They also need deep knowledge of,and experience within their respective industries.

Janice Ochenkowski, who just completed her term as president ofthe Risk and Insurance Management Society, said with theproliferation of risks worldwide in a struggling economy, sheexpects a greater demand for CROs.

“I don't have any data to support an increase in CROs, butintuitively it seems that as companies are paying more attention toenterprise risk management, there will be an evolution to CROs,”said Ms. Ochenkowski, director of global risk management with JonesLang LaSalle in Chicago.

She added that although the title may not necessarily be that ofCRO, “it will be the job description of a senior-level person incharge of risk management and assessment that will continue tothrive.”

Ms. Ochenkowski advised traditional risk managers looking toupgrade to the CRO position to “make senior management more awareof their internal expertise in solving risk issues facing theorganization.”

She added that basic to the CRO post is knowing their ownbusiness. “You need to not be the insurance person but someone whounderstands your industry and can help to assess risk/benefitrewards on a strategic level,” she explained.

Those who can demonstrate such abilities, she said, will “moveforward in your organization–you will be a value-add tomanagement.”

On the other hand, those whose only contribution is as a“conduit into the insurance industry,” she said, will “always be anoutsider to the businesses. You may be valued, but you're notassessing the risks with senior management.”

And while the current financial crisis presents untold risks fororganizations, it can also provide opportunities, she noted.

“For a risk professional to show an understanding of those risksand discuss with management some potential solution strategies formitigation is invaluable,” said Ms. Ochenkowski. “With adversitycomes opportunity, and this is a great opportunity for riskmanagers to move forward.”

Jeffrey Driver, CRO at Stanford University Medical Center inPalo Alto, Calif., has been at Stanford for five years, and cameinto the job as a CRO. Stanford, he said, was an early adopter ofthe position.

“As a CRO, you are basically responsible for all aspects of riskacross the organization, from corner to corner,” he explained. “Youcould distinguish that from other types of managing risk. Some usea silo approach.”

He said a CRO in the health care field can cross over fromemployment risks, to workers' compensation, to professionalliability, and also manage a captive insurer.

Mr. Driver is a member of the senior staff and has threedirectors–a senior director of finance, a senior director who is anattorney in claims and litigation, and a senior director in riskmanagement who manages loss control for the organization.

Although he said he “fell into” the CRO position, he was,without a doubt, prepared. “I have a number of degrees and can seethings from different viewpoints,” he noted. Those degrees includebusiness finance and law, “and I also practice clinically. So in myprofession, I can see risks holistically from variousviewpoints.”

Mr. Driver explained that other skills are needed as well. “Ifyou can peel away the intellectual part, the ability to work withsenior management at all aspects of risk is very important–beingable to get things done in a complex system.”

Although these skills are necessary for success, they “aren'tthe things you learn in school, and I'm not sure they can betaught, but it's something you have to be able to do,” he said.“Because you're going to come across some situations that willrequire a lot of effort to control the risk, and you have to workwith senior management to correct them.” That includes finding waysto confront and control even the most challenging risks.

“We have to find ways to do things,” he explained. “I tell oursenior management: 'It's not our job to say no. It's our job tofind a way.' We're specialists in mitigating the risk, so veryrarely will we go in and say, 'No.' We try to find the safest waypossible.”

Emphasizing that “insurance is just one aspect of the total riskmanagement package,” he agreed it's important for a risk manager toknow the industry in which they're involved, inside and out. “Ipractice as a therapist, so I've walked the walk,” he said. “For meto cross into another field as a CRO would be difficult because Iwould have to understand the risk.”

To widen your knowledge base, he advised getting involved in aprofessional society, such as RIMS or the American Society forHealthcare Risk Management. Another association, the Public RiskManagement Association, is available for public sector riskmanagers.

Mr. Driver agreed that a CRO also must look at riskstrategically, citing the broader thinking he must employ inmanaging the organization's captive. With about 200 claims a year,he said proper coding “tells us a story about where our losses are.We can determine the driving factors of losses in our hospitals andmedical groups.”

For example, he said, the data showed that a contributing factorto losses was poor communication among providers, physicians andpatients. To remedy the situation and enhance communications, hesaid the organization turned to online education for patients andtheir families.

Now, Mr. Driver noted, “when the patient comes to us, they arebetter prepared. This year we're not seeing the same issues we wereseeing, and so now we're moving to other issues.”

James D. Birchfield, CRO for Aggregate Industries ManagementInc., in Rockville, Md., a global supplier of buildingmaterials–distributing aggregates, sand and gravel, and asphalt in74 countries–said he is surprised there aren't more CROs, “givenSarbanes-Oxley [compliance and reporting requirements for publiccompanies] and given the recent meltdown in all of the financialmarkets.”

He observed, however, that “unfortunately, I've met a lot ofpeople who call themselves risk managers that are nothing more thaninsurance buyers. So I'm sure that's part of it.”

If you weeded out the true risk managers, he added, thoseactually managing risk within their corporations in anenterprisewide approach “would be the people who would be eligibleto be upgraded to a CRO position,” estimating “that's probably 10percent of the people who call themselves risk managers.”

CROs are typically found in large organizations, although Mr.Birchfield said that with globalization and other challenges, thereshould be more CRO-level positions in smaller companies–includingthose with as little as $100 million in revenues. (Mr. Birchfieldcharacterized his own firm as “about a $2 billion company in theU.S. and about $30 billion globally.”)

What sometimes limits CROs, however, is “the company'sreluctance to let a risk manager take on the full role,” he said.“The board has to recognize the value of a true risk managementprofessional and have them involved in every aspect of thebusiness.”

To make their way into the C-Suite, he said, risk managers needto speak up and continually sell their value and ability to thechief executive officer, chief financial officer and the board.

They need to “get involved in as many parts of the company asthey possibly can,” he advised. “If they're only an insurancebuyer, they need to get out into operations and learn about that.Chum up to the controller or the head of the finance department.They need to get out there and toot their own horn. That's the onlyway it's going to happen.”

Most importantly, he said, they must let other senior companyofficials know what more they can do for them. For example, he saidhe lets contract bidders know that “they don't necessarily have tobid jobs that high, because here are your surety costs, here iswhat we're going to back-charge, and we can fine-tune theirbids.”

Eamonn Cunningham, CRO of Westfield Ltd. in Sydney, Australia–aretail property developer, owner and manager that owns about 120shopping centers in the United States, Australia, New Zealand andthe United Kingdom–is a believer in working into the position witha company.

“I'm in my 22nd year,” he noted. “I've come up through the ranksand have been CRO about two-and-a-half years.”

Mr. Cunningham began with the company as a certified publicaccountant working in the finance area. He moved intoadministration, with the responsibility of procuring insurance.

“When I moved into that area about 12 years ago, I saw there wasa cleverer way of looking at risk management, so I broughtWestfield along on a journey from procuring insurance thetraditional way, to basic risk management, to the introduction ofERM about three years ago–what I like to call the 'enlightened'risk management phase.”

As a result of his efforts, the CRO position was created forhim, he said.

While some organizations are constantly looking to improveprofitability, he said his own firm, while still very conscious ofthe bottom line, has other priorities as well.

“Our reputation is absolutely invaluable, and we wanted toinsure that there was nothing lurking in our vast operation thatcould adversely impact our reputation–one of our key risks,” hesaid, noting that the company wants to prevent something unexpectedhappening that could retard the company's growth.

His advice to risk managers looking to advance was simple: “Bevery clear about what you want to achieve, and work hard toinfluence the people whose support you need to make it happen.” Inhis case, he said, “fortunately, the senior managers wereincredibly supportive.”

Although support from the top is critical, he added, “you alsomust be working on support from middle management. If you don'tbring middle management on this journey with you, then you're notgoing to succeed. Your program will be on a very, very rockyjourney.”