3
The Architecture of Accountability 5:59 Jackson: So, if the CMS is the blueprint, who’s actually the architect? I’ve been seeing a lot of debate lately about the role of the Chief Risk Officer—the CRO—versus the Chief Compliance Officer, the CCO. Some people say they should be the same thing, but others argue that’s a recipe for disaster.
6:17 Nia: It’s a classic "separation of powers" debate. Think of the CRO as the orchestra conductor—they’re looking at the whole enterprise, all the strategic and financial risks combined. But the CCO? They’re like the lead violinist. They have this incredibly specialized expertise in regulatory requirements. If you just submerge compliance under a general risk function, the CRO might not see a regulatory storm coming until the enforcement action hits.
6:44 Jackson: That makes sense. You need that independent voice. I read a piece by Kristy Grant-Hart where she explained that regulators actually look for this. If the compliance function doesn't have a direct line to the board—if they're filtered through three other layers of management—the regulator sees that as a red flag. It’s like having a smoke detector that only alerts the landlord, who might decide not to tell the tenants there’s a fire.
7:08 Nia: Ha! Exactly. And the RBI’s new 2025 Governance Directions are actually codifying this. They’re making it very clear that the CRO needs to be an "empowered" role. They shouldn't be wearing "dual hats"—meaning they can’t be the CFO or the head of internal audit at the same time. They need to be the institutional conscience. In fact, the Risk Committee is now supposed to meet the CRO at least quarterly *without* the MD or CEO in the room.
7:34 Jackson: Oh, that’s a huge move. That creates a safe space for the CRO to say, "Hey, we’re pushing too hard in this area and the risk is getting out of control," without worrying about the CEO's reaction. It’s about preventing "management capture."
7:50 Nia: Right. And this ties into the "Three Lines of Defense" model that’s becoming the gold standard in Indian corporations. The first line is your operational management—the people doing the business day-to-day. They "own" the risk. The second line is the risk and compliance functions—they set the frameworks and monitor everything. And the third line? That’s internal audit. They’re the independent eyes making sure the first two lines are actually doing what they say they’re doing.
8:14 Jackson: I like that. It’s like having a player, a referee, and then a league official reviewing the game tape. But I’ve heard that in practice, the "first line"—the business teams—sometimes view risk as a "no" department. How do you get them to actually take ownership?
8:30 Nia: That’s the million-dollar question. One of the experts from KPMG, Naveen Aggarwal, had a great quote about this. He said internal audit earns its relevance not through the "findings" it raises, but through the "first-line judgment" it shapes. The goal is to make sure the "blind spots" never become failures in the first place. It’s about moving away from "looking in the rearview mirror" to what they call "crystal gazing"—predicting where the pressure will build next.
8:54 Jackson: "Crystal gazing" sounds much more exciting than "auditing." But it requires a massive shift in culture. You mentioned the "tone at the top" earlier. If the board doesn't take this seriously, no one else will. I noticed the new RBI directions are really pushing boards to be "stewards, not spectators." They have to be familiar with the delegation matrices and the control systems even *before* they take their seats.
9:20 Nia: And for private sector banks, the "fit and proper" requirements have become incredibly granular. They’re not just looking at your degree or your age anymore; they’re looking at your criminal and regulatory history, your financial position, and even your links to other interconnected entities. They even have a "don't" list for non-executive directors—like, no sponsoring individual loans, no meddling in staff promotions, and no using the bank’s logo on your personal visiting cards!
9:46 Jackson: Wow, they really went there. It sounds like they’re trying to clean up a lot of "past abuses" where directors were using their positions for personal influence. It’s about professionalizing the board and making sure they’re focused on policy and macro trends rather than micro-managing the branch manager.
5:39 Nia: Exactly. And this extends to leadership terms too. You can’t have "permanent" CEOs anymore. There’s a 15-year cap for MDs and CEOs in private banks, and even shorter if you’re a promoter-shareholder. It’s a "governance lever" to prevent "key man" institutions. It forces the bank to evolve into a professionally governed entity that doesn't just depend on one charismatic leader.
10:23 Jackson: It feels like the regulator is trying to build a system that can survive even if the "architect" leaves. Which brings us back to that idea of resilience. If you have the right architecture—independent CROs, clear reporting lines, and a board that’s actually engaged—you’re building a company that’s ready for the "Black Swan" events.
10:44 Nia: And that’s where the "Risk and Reward" alignment comes in. The 2025 Directions are very explicit about remuneration. You can't just pay big bonuses for short-term profits if those profits were made by taking reckless risks. Variable pay has to be "truly variable"—meaning it can be reduced to zero if the risk outcomes are bad. They’re even calling for "clawbacks" in some cases.
11:07 Jackson: "Clawbacks"—that's a tough word for any executive to hear. But it makes so much sense. If your bonus was based on a house of cards that collapsed a year later, why should you get to keep it? It aligns the executive's personal interests with the long-term stability of the firm.
11:23 Nia: It really does. It’s about making governance a "lived reality" rather than a paper exercise. And as we'll see, when you combine this high-level accountability with the right technology, you get something really powerful—the ability to see those "small anomalies" before they turn into headlines.