CEO Executive AssistantOperational Risk Management Coordination Is Now a CEO-Level Discipline
Operational risk has moved from a compliance checkbox to a board-level strategic priority across the financial services industry. Regulatory expectations from the Basel Committee, the Federal Reserve, the OCC, and international supervisors have made operational risk capital adequacy and governance framework rigor a direct measure of institutional quality. For finance CEOs, this means that operational risk management coordination is not something to delegate entirely to the Chief Risk Officer. It requires regular, informed CEO engagement across committee governance, capital reporting, third-party oversight, and board communication.
Operational risk management coordination generates a continuous flow of committee meetings, reporting cycles, briefing requirements, and stakeholder engagements that must be organized into a coherent schedule without crowding out the CEO’s other strategic priorities. The executive assistant who manages this administrative architecture is a direct enabler of the CEO’s ability to lead operational risk governance effectively, not just attend meetings.
This article outlines the specific administrative disciplines that allow an EA to support a finance CEO running an operational risk management program at a bank, asset manager, insurance company, or other financial institution.
Scheduling Operational Risk Committee Review Meetings
The operational risk committee is the primary governance forum for reviewing the firm’s operational risk profile, assessing loss events, evaluating key risk indicators, and making decisions about risk appetite and control investment priorities. The CEO’s participation in this committee, whether as chair, voting member, or executive observer, requires structured preparation and disciplined scheduling.
The EA owns the operational risk committee calendar. For a standing committee that meets monthly or quarterly, the EA establishes meeting dates at the start of the year, coordinates with the Chief Risk Officer’s office to confirm agenda ownership, and protects the dates on the CEO’s calendar against displacement by lower-priority requests. When special sessions are required, such as when a significant operational loss event occurs or a regulatory examination finding requires immediate governance response, the EA facilitates rapid scheduling that gets the right participants together without bureaucratic delay.
Pre-meeting preparation defines how effectively the CEO can participate. The EA establishes a materials submission deadline of 48 to 72 hours before each committee meeting, reviews the submitted agenda and briefing package for completeness, and flags any gaps or inconsistencies to the risk management team before the package reaches the CEO. A CEO who arrives at an operational risk committee meeting having reviewed well-organized, complete materials contributes substantively to the governance process. One who encounters the materials for the first time in the meeting is a liability.
After each committee meeting, the EA documents key decisions, action items, and escalations, distributes the summary to participants within 24 hours, and tracks completion before the next session. Operational risk governance produces value only when decisions are executed. The EA’s follow-through discipline is what converts committee discussions into institutional action.
For EAs supporting finance CEOs who also manage board-level risk reporting alongside operational risk committee governance, board meeting coordination support provides a complementary framework for structuring director engagement on risk matters.
Coordinating RCSA Briefings
The risk and control self-assessment process is the foundational mechanism through which financial institutions identify, assess, and document the operational risks and control effectiveness across their business lines and functions. For a large or complex financial institution, RCSA cycles involve dozens of business units, hundreds of risk and control pairs, and significant analytical work by the operational risk management team. The CEO’s engagement with the RCSA is not at the individual risk-and-control level. It is at the portfolio level: where are the highest-rated residual risks, where are controls rated as inadequate, and where does the risk profile suggest that management attention or capital investment is needed?
The EA structures the CEO’s RCSA engagement around a defined briefing cycle. When the annual RCSA is completed, the EA schedules a portfolio-level briefing from the Chief Risk Officer that presents the CEO with the key findings: the risk categories with the highest residual risk ratings, the business units with the most significant control gaps, the changes in the risk profile since the prior year, and the management actions proposed to address the highest-priority findings.
Mid-year RCSA updates require their own briefing cadence. When material changes occur in the risk profile, whether from new business activities, operational incidents, regulatory findings, or technology changes, the EA coordinates an updated briefing rather than waiting for the next scheduled cycle. The CEO needs to know when the risk landscape has shifted materially. The EA’s discipline in tracking the RCSA calendar and escalating updates promptly is what makes that awareness possible.
The EA also manages the documentation that connects RCSA findings to management decisions. When the CEO directs the risk team to increase control investment in a specific risk category, or to conduct a deeper assessment of a particular business unit, the EA tracks that direction and confirms follow-through, ensuring that RCSA findings translate into management action rather than sitting in a governance document.
Tracking AMA and Standardized Approach Capital Reporting Cycles
Operational risk capital requirements under Basel III and its successors represent a significant and closely watched component of the firm’s capital adequacy position. Whether the institution uses the Standardized Approach or has historically operated under an Advanced Measurement Approach framework, the capital reporting cycle generates regular deliverables that the CEO needs to stay current on: quarterly capital calculations, stress test results with operational risk components, regulatory capital ratio reporting, and the narrative around operational risk capital that flows into investor communications.
The EA maintains the operational risk capital reporting calendar, tracking the quarterly calculation cycle, the submission deadlines for regulatory capital reports, the stress testing calendar, and any special reporting requirements from the firm’s primary regulator. For each reporting event, the EA knows which team owns the deliverable, when drafts are due for CEO review, and what the final submission deadline is.
The CEO’s review of operational risk capital reports is focused on the strategic dimensions: how the capital calculation has changed from the prior period, what loss event history is driving the calculation, how the firm’s operational risk capital compares to peer institutions, and what the implications are for capital allocation and dividend or buyback capacity. The EA prepares the agenda for each capital reporting review session so the CEO can focus on these strategic questions rather than working through the mechanics of the calculation.
When operational risk capital results are material inputs to investor communications or board reporting, the EA coordinates the information flow. Results from the capital calculation team need to reach the investor relations and finance teams with enough lead time for integration into earnings materials or board packages. The EA owns this coordination, ensuring that information moves on a schedule that serves the downstream communications process.
Investor communications support provides a framework for how EAs can coordinate the CEO’s engagement with investors on risk capital and operational resilience topics as part of the broader investor relations program.
Managing Third-Party Operational Risk Review Meetings
Third-party operational risk has become one of the most significant and closely scrutinized dimensions of the operational risk profile at financial institutions. Regulators including the OCC, Federal Reserve, and FDIC have issued detailed guidance on third-party risk management expectations, and examinations increasingly focus on whether financial institutions have adequate governance over the operational risks embedded in their vendor and service provider relationships.
For the CEO, third-party operational risk oversight means staying informed on the firm’s most critical third-party relationships, the operational risk exposure associated with those relationships, and the effectiveness of the third-party risk management program in identifying and managing that exposure. This engagement happens through a structured rhythm of third-party risk review meetings that the EA schedules and prepares.
The EA works with the third-party risk management function to define the appropriate CEO-level engagement cadence. Tier 1 critical vendors, those whose failure or disruption would have immediate and severe operational impact, warrant annual CEO-level review sessions. The overall third-party risk program warrants a quarterly status briefing that gives the CEO portfolio-level visibility on concentration risk, due diligence completion rates, and remediation status for vendors with identified risk issues.
Before each third-party risk review session, the EA prepares a briefing package from the third-party risk team’s inputs: the list of critical vendors under review, the risk ratings for each, any due diligence findings that have emerged since the last review, the current remediation status for known issues, and any upcoming contract renewals for critical relationships that require CEO engagement. The CEO arrives knowing which vendors present the most significant current risk and what decisions the firm needs to make about those relationships.
When a third-party incident occurs, such as a vendor security breach, a service disruption from a critical provider, or a regulatory action against a key vendor, the EA coordinates a rapid briefing that gets the CEO informed and engaged without delay. Third-party incidents can escalate quickly, and the CEO needs to be ahead of the situation before it reaches regulators, clients, or the media.
Preparing Board Presentations on Operational Risk Profile and Resilience Investment
The CEO’s board presentations on operational risk must give directors a clear, honest picture of the firm’s operational risk profile, the trends in key risk indicators, and the strategy and investment plan for improving operational resilience. Boards are expected by regulators to actively engage with operational risk governance, and directors who receive clear, well-organized presentations are better positioned to fulfill that expectation.
The EA manages the board prep process with a structured timeline beginning three weeks before each board meeting. They establish which operational risk topics require board-level visibility, identify materials owners in the risk management, finance, and technology teams, set submission deadlines, and consolidate contributions into a coherent package with version control throughout.
Operational risk profile reporting covers the key metrics that allow directors to assess the firm’s risk position: loss event frequency and severity trends, key risk indicator trends against defined thresholds, RCSA summary results by risk category and business unit, and any regulatory examination findings or supervisory concerns related to operational risk. Each metric should be presented with appropriate context: how does current performance compare to prior periods, to the firm’s risk appetite, and to peer benchmarks where available?
Key risk indicator trends deserve particular attention. KRIs are the forward-looking signals that warn of deteriorating risk conditions before loss events occur. When KRIs are trending adversely, the board presentation should explain what is driving the trend, what management is doing in response, and when improvement is expected. A board that sees KRI trends without context cannot make informed governance judgments.
Operational resilience investment strategy is the forward-looking dimension of the board presentation. The CEO needs to articulate the firm’s plan for strengthening operational resilience across the key risk domains: technology and cyber resilience, third-party concentration risk reduction, business continuity capability, and people and process control improvements. This plan should connect investment requirements to risk reduction outcomes in a way that supports board approval and oversight.
According to McKinsey’s analysis of operational risk management in financial services, financial institutions that invest in integrated operational risk management frameworks achieve materially better loss outcomes and regulatory relationships than those that treat operational risk as a compliance exercise. The board presentations that the CEO and EA prepare together are the governance mechanism through which that investment strategy is authorized and overseen.
Operational Risk Management Coordination Rewards Administrative Rigor
Operational risk does not stay contained in governance documents. It manifests in the events, losses, and regulatory findings that affect the firm’s reputation, capital position, and strategic options. The CEO who is consistently well-informed on the firm’s operational risk profile, the trends in key indicators, and the status of the risk management program is in a fundamentally stronger position to manage and improve it.
Finance CEOs who build rigorous administrative infrastructure around operational risk management coordination consistently find that their EA’s discipline on scheduling, briefing preparation, and reporting cycle management is what allows them to lead operational risk governance effectively. The complexity of operational risk management coordination rewards precisely the kind of systematic, thorough administrative support that a skilled executive assistant delivers.