Family B · Risk leadership and governance · Coming soon
Certified Chief Risk Officer
The one who answers for everything that can go wrong.
Notice
Upcoming certification. It carries no regulatory recognition and does not inherit the designation the Institute's current certifications hold before CONSAR and CNSF. Modules, hours, weightings and exam format come from the program calendar and blueprints and may be adjusted before opening.
CCRO
01 — ABSTRACTCertified Chief Risk Officer
The risk function has changed in kind. It was born in banking to measure a trading book in dollars over a defined horizon; today it answers for capital, liquidity, models, cyber, climate and conduct across institutions that are no longer only banks. Insurers, pension funds, broker-dealers, captive finance companies, fintechs and the regulator itself require the same technical depth, and the available training remains vertical: each credential covers one slice.
Certified Chief Risk Officer certifies the whole function, not a single technique. It tests whether the person who leads risk can challenge a model built by someone else, defend capital and liquidity before the supervisor, calibrate appetite against strategy and bring the board a narrative with actionable signals. It is designed for the director's seat, not the specialist's, with a view across nine sectors of the financial industry and three reference jurisdictions: the United States, Europe and Mexico.
The RiskMathics Certificate Institute issues the credential; RiskMathics Financial Institute delivers the preparation program: 25 modules, 135 sessions and 337.5 hours between October 2026 and December 2027, with one capstone per module and a closing War Room. The exam may be taken without enrolling in the program. The first sitting is scheduled for 2028. The certification holds no regulatory recognition of any kind today.
CCRO
02 — INDUSTRYWhat is happening in the industry
The CRO has moved from risk police to strategic architect. McKinsey's research with sitting chief risk officers finds that the most effective spend more than half their time with the executive team and the board, and roughly a third with the risk function itself. The job is decided by influence and judgment, not by calculation.
Individual accountability regimes are spreading. The UK's SMCR and Australia's FAR assign the chief risk officer personal responsibility for taking reasonable steps, and the European Central Bank explicitly accepts training prior to appointment as a compensating factor in its fit-and-proper assessments. Demonstrable competence in the person who runs risk is becoming a matter of supervision.
The CRO's agenda is widening faster than the CRO's training. The 2025 EY/IIF survey of 115 banks in 45 countries ranks cybersecurity as the top priority and places climate and AI risk as the dominant concerns over the next five years. Forty-two percent of respondents acknowledge talent as a significant constraint.
CCRO
03 — WHYWhy this certification
The market already certifies the risk analyst; it does not certify the director. The FRM and the PRM measure technical mastery and describe themselves as stepping stones toward the CRO seat. No existing credential examines risk governance, board reporting, the relationship with the supervisor and command in a crisis. That is the gap Certified Chief Risk Officer closes.
The credential rests on an executive program that already runs, not on a promise. Its 25 modules, 25 capstones and closing War Room exist with a defined calendar, syllabus, deliverables and price. The exam is built on a proprietary item bank that accounts for 70 % of each form and inherits the remainder from the Institute's common modules: risk appetite and governance, the Basel capital framework, the SAR regime and climate risk.
- An integrated view across nine sectors: banking, insurance, pensions, broker-dealers, corporates, captive finance companies, fintechs, SOFIPOs and SOFOMs, and the regulator.
- Three reference jurisdictions: the United States, Europe and Mexico, covering Basel III and its final reforms, the CNBV's CUB and the SAR regime.
- It examines the whole function: capital and ICAAP, liquidity, models and AI, cyber, third parties and data, climate, geopolitics and conduct.
- Against GARP's FRM: the FRM measures quantitative risk; this certification measures the function, its governance, its committee and its relationship with the board.
- Independence: the party that teaches is not the party that examines. RiskMathics Financial Institute delivers the program; the RiskMathics Certificate Institute builds and administers the exam.
CCRO
04 — OUTCOMESWhat it prepares for
- 01
Design and operate the institution's integrated risk model (ERM, risk appetite and three lines of defense), aligned with strategy.
- 02
Measure and govern market, credit, liquidity, ALM/IRRBB and capital risk with quantitative rigor, and challenge the models beneath them.
- 03
Defend capital and liquidity before the regulator: ICAAP, FRTB, LCR and NSFR, integrated stress testing and reverse stress testing.
- 04
Govern the technology of risk: model inventory and validation, AI and machine learning, cyber, risk data aggregation under BCBS 239 and operational resilience.
- 05
Integrate emerging risks into the framework: climate and ESG, geopolitics, fintech and digital assets, financial crime.
- 06
Lead the function from the human side: risk culture, talent, organizational design and influence without formal authority.
- 07
Orchestrate the risk committee and report to the board with an executive narrative, an appetite dashboard and actionable red flags.
- 08
Command a crisis in the War Room and activate recovery and resolution plans.
CCRO
05 — INSTITUTIONSThe cut-off line
An institution that requires Certified Chief Risk Officer of the person who runs its risk function sets a verifiable threshold where today there is only a résumé and an interview. The credential attests that the holder can sustain an ICAAP before the supervisor, calibrate appetite against the target return and explain to the board, in its own language, what can go wrong and what will be done about it.
For the board and the nominations committee, certification lowers the cost of a decision that can rarely be repeated. For the regulator, it is evidence of training prior to appointment, the same criterion that European fit-and-proper assessments recognize as a compensating factor. For the internal candidate, it is the explicit route from the second seat to the first.
- A common language across risk, finance, audit and the board, built on frameworks the exam verifies: COSO ERM, ISO 31000, the FSB principles, Basel, SR 11-7 and BCBS 239.
- Succession with a standard: deputy CROs and heads of risk are measured against the same bar as the incumbent.
- Board reporting with structure: appetite, utilization, gaps and recommendations, not data alone.
- Command capacity proven in a multi-risk crisis simulation, before the crisis happens.
CCRO
06 — PROFILEWho it is for
Who it is for
- CROs, deputy CROs, heads of risk and directors of integrated risk management (UAIR) who answer to the board and the regulator.
- CFOs, treasurers and heads of ALM who govern the balance sheet, liquidity and capital.
- Senior managers in market, credit, liquidity, operational, cyber and model risk who are one step from the seat.
- Board members, risk and audit committee members, and supervisors at CNBV, Banxico, CONSAR, CNSF and CONDUSEF who need the same technical depth as the institutions they oversee.
Who it is not for
- Anyone seeking a quantitative specialist credential; the FRM, the PRM or, within this catalogue, Financial Derivatives Specialist serve that purpose.
- Anyone who needs a certification required today by CONSAR or CNSF: this certification carries no regulatory recognition and does not replace the current ones.
- Anyone expecting an attendance course: the credential is earned by examination, and the program is passed through 25 capstones and a final defense.
CCRO
07 — KNOWLEDGEBody of knowledge
Six domains derived from the five blocks of the preparation program; the analytics and emerging-risk block splits into two. Weights are indicative and reflect each domain's share of program hours. The official exam weighting is set by the academic committee and published with the call for candidates.
01Foundations, risk governance and appetite16 %
- Global financial markets for risk leaders: transmission channels and contagion
- ERM operating model: COSO ERM, ISO 31000 and Basel; roles, committees and policies
- Risk Appetite Framework: from the board's RAS to tolerances, KRIs and business-line limits
- Three lines of defense and risk governance, including the SAR regime: UAIR, financial risk committee and supervision
- Quantitative risk toolkit: loss distributions, VaR and Expected Shortfall, Monte Carlo, GARCH, PD/LGD/EAD and backtesting
02Financial and balance-sheet risk32 %
- Market risk: risk factors, sensitivities, VaR/ES, P&L explain and the limits framework
- FRTB: standardized and internal models approaches, NMRF and P&L attribution
- CVA and xVA: calculation, control, hedging and desk governance
- Modern AI credit risk: origination, scoring, IFRS 9/ECL and early warning
- Liquidity and FTP: LCR, NSFR, HQLA, contingency funding and funds transfer pricing
- ALM and IRRBB: EVE, NII, repricing gaps and ALCO orchestration
- Capital adequacy: RWA, Basel III and its final reforms, economic capital, ICAAP and capital planning
03Operational, cyber and non-financial risk21 %
- Operational risk and resilience: taxonomy, RCSA, KRIs/KCIs and business continuity
- Cyber and technology risk: NIST frameworks, incident response and quantification in business terms
- Third parties, concentration and outsourcing; risk data aggregation and quality (BCBS 239)
- Financial crime and reputational risk: AML/CFT, sanctions, fraud and conduct
- Model risk management and AI/ML governance: inventory, independent validation, explainability, bias and drift
04Advanced analytics, AI and stress testing11 %
- Integrated stress testing and reverse stress testing: from the macro scenario to capital, liquidity and P&L
- Risk analytics lab with AI in Python: pipelines, interpretable scoring and anomaly detection
- Generative AI and quantum computing in risk management: opportunities, limits and realistic adoption horizons
- Translating stress and analytics results into business decisions and a defense before the regulator
05Emerging risks: climate, geopolitics and the digital economy9 %
- Climate and ESG risk: physical and transition risk, NGFS scenarios, financed emissions, TCFD and ISSB
- Geopolitical risk and strategic intelligence: sanctions, fragmentation and translation into exposure
- Fintech, digital assets and digital conduct: open finance, Mexico's Fintech Law (ITF) and the EU's MiCA
- Integration of emerging risks into the institution's risk appetite, ICAAP and KRIs
06Leadership, crisis and the board11 %
- The human factor: risk culture, bias, organizational design, talent and influence without authority
- The CRO in the boardroom: risk committee orchestration, appetite dashboard, narrative and red flags
- Crisis, recovery and resolution: activating the recovery plan, deciding under time pressure and communicating with the regulator and the market
- The War Room: an integrating multi-risk crisis simulation with decisions defended before the board and the regulator
- Regulator relations and executive communication
CCRO
08 — TWO PRODUCTSPreparation program · Certification exam
Preparation program
Preparation program
Program delivered by RiskMathics Financial Institute
Chief Risk Officer — Global Advanced Enterprise & Financial Risk Management Executive Program is delivered by RiskMathics Financial Institute in a Virtual Live format: 25 modules, 135 sessions of 2.5 hours and 337.5 hours, from 26 October 2026 to 7 December 2027. It covers the full exam syllabus and includes mock exams built to the same recipe as the exam. The methodology is a rotating team War Room: every module closes with a capstone defended before a simulated risk committee, and the program ends with a multi-risk crisis simulation. Those who complete the program and pass the final capstone receive the executive program certificate; the Certified Chief Risk Officer credential is earned only through the RiskMathics Certificate Institute exam.
Chief Risk Officer — Global Advanced Enterprise & Financial Risk Management Executive Program
337.5 hAll 25 modules and 25 capstones, including the closing War Room. The only format that covers the full exam syllabus. USD 18,500 + TAX.
Five blocks by specialty
37.5 to 107.5 hFoundations & Risk Governance (modules I to IV), Financial & Balance-Sheet Risk (V to XI), Operational, Cyber & Non-Financial Risk (XII to XVI), Analytics, AI & Emerging Risk (XVII to XXII) and Leadership, Crisis & Board Mastery (XXIII to XXV). Between USD 2,575 and 7,375 + TAX per block; no single block covers the exam syllabus.
One module at a time
7.5 to 20 hFor closing a specific gap. Between USD 725 and 2,400 + TAX per module, depending on its tier.
- 25 capstones, one per module, defended before a simulated risk committee with technical and executive feedback
- THE WAR ROOM: the closing crisis, recovery and board command simulation
- AI Lab in Python, Capital and ICAAP, and a board-ready Risk Appetite Framework
- Mock exams built to the certification exam recipe, using Bloom levels 1, 2 and 3
- United States, European and Mexican perspectives; rotating teams that mix sectors
- CRO Summer: two full weeks off in August 2027, in addition to the year-end and Easter breaks
26 October 2026 to 7 December 2027. Sessions of 2.5 hours on Monday, Tuesday and Thursday, 7:00 to 9:30 pm (Mexico City), plus selected Wednesdays. About 13.5 months, with off weeks between blocks.
Certification exam
Certification exam
Built, audited and administered by the RiskMathics Certificate Institute as an independent third party. It may be taken with or without having completed the preparation program. The first sitting is scheduled for 2028; eligibility requirements are published with it.
If the candidate does not pass
The Certification Board is defining the failure and retake policy: how many attempts each window allows, the minimum wait between them and the fee for sitting the exam again. It is published here as soon as it is approved; in the meantime, the figures may be requested at growth@riskmathics.com. Exam governance →
Items are written at levels 1, 2 and 3 of Bloom's taxonomy: remember, understand and apply. Each form follows a fixed recipe by domain and by level, so that any two candidates face the same demand. Bloom's Taxonomy →
CCRO
09 — MOCK EXAMSMock exams
Mock exams reproduce the exam recipe: the same distribution by domain and by Bloom level, the same length and the same item type. They are not a review; they are a rehearsal under real conditions.
They are drawn from the Institute's item bank at Bloom levels 1, 2 and 3 and administered under the same exposure control as the exam: no candidate sees the same item twice within 24 months. Results are reported by domain, so that the candidate knows where to concentrate the weeks that remain.
- Same format and length as one exam form: 120 items
- Feedback by domain and by Bloom level
- Included in the preparation program; availability for candidates who sit the exam without the program to be confirmed
CCRO
10 — PATHLearning path
- Phase 1
Foundations and risk governanceOctober 2026 to January 2027 · modules I to IV · 55 h
Global markets for risk leaders, the ERM operating model, the Risk Appetite Framework and the quantitative toolkit. Includes the board's RAS with a breach drill and a model built, documented and challenged by another team.
- Phase 2
Financial and balance-sheet riskJanuary to May 2027 · modules V to XI · 107.5 h
Market risk, FRTB, xVA, AI-driven credit, liquidity and FTP, ALM and IRRBB, and capital adequacy. Closes with the ICAAP defense before a simulated supervisor.
- Phase 3
Non-financial risk, models and analyticsMay to October 2027 · modules XII to XXII · 137.5 h
Operational, cyber, third parties and data, financial crime, model risk, integrated stress testing, the AI Lab, the quantum frontier, climate, geopolitics and digital risk.
- Phase 4
Leadership, the board and the War RoomNovember to December 2027 · modules XXIII to XXV · 37.5 h
Culture and talent, the CRO in the boardroom and the closing crisis simulation. The program is passed by defending the integrating capstone.
- Phase 5
Mock exams and certification exam2028 · date to be confirmed
Rehearsal to the exam recipe, feedback by domain and the RiskMathics Certificate Institute exam at its first sitting.
Investment
11Program and exam, priced separately
List prices in US dollars, plus the tax applicable in the country of invoicing. Program and exam are contracted separately; neither figure includes the other.
CCRO
12 — FAQFrequently asked questions
Can the exam be taken without the program?
Yes. The exam is administered by the RiskMathics Certificate Institute as an independent third party and is open to anyone who meets the eligibility requirements published with the call for candidates. The preparation program is the recommended route because it covers the full syllabus and includes mock exams, but it is not a condition.
What does someone who completes the program without sitting the exam receive?
The Chief Risk Officer Executive Program certificate, issued by RiskMathics Financial Institute after passing the final capstone under a 360° evaluation. The Certified Chief Risk Officer credential is earned only by passing the RiskMathics Certificate Institute exam.
Does it carry regulatory recognition?
No. Certified Chief Risk Officer certifies knowledge and competence; it is not endorsed by any regulator and does not inherit the designation the Institute's current certifications hold before CONSAR and CNSF. Nor does it replace the risk management director designation the CNBV requires of banks.
How does it differ from the FRM?
The FRM measures quantitative risk and describes itself as a stepping stone toward the CRO seat. Certified Chief Risk Officer measures the whole function: governance, appetite, capital, the risk committee, the relationship with the regulator, crisis and board reporting. They are complementary; an FRM holder finds here the next rung.
When is the first exam, and how many forms are there?
The first sitting is scheduled for 2028; the calendar is published with registration. The exam is built in two equivalent forms of 120 items, with 70 % from the certification's own bank and 30 % inherited from the Institute's common modules.
In what language are the program and the exam delivered?
The program is taught in Spanish, with technical material and some modules in English (about 40 %); intermediate reading of technical English is recommended. The exam language is to be confirmed.
Certified Chief Risk Officer
The one who answers for everything that can go wrong.