Shifting from resilience to responsible growth: A CRO’s perspective

As Chief Risk Officer (CRO) at ABN AMRO, I see resilience not as an end state, but as the foundation for better decisions in an environment shaped by geopolitical uncertainty, macroeconomic volatility, the climate transition, regulatory expectations and rapid technological change.

For risk management, resilience is about helping the bank identify where we can grow safely, sustainably and profitably, and where clear boundaries are needed. For a CRO, it is not about taking more or less risk, but about taking the right risks. In this article, I reflect on how stronger resilience and de-risking can create room for growth.

The resilience evolution: Business continuity management to preparedness

In our sector, we have moved from a relatively stable period prior to the Covid pandemic, when business could focus primarily on efficiency and profit optimisation, into a more volatile and unpredictable environment. Cost discipline and profitability remain important, but organisational and operational continuity now demands greater attention.

Resilience has to be viewed beyond simply the balance sheet.

Events once considered highly unlikely are increasingly plausible, requiring us to prepare for disruption and limit its impact. This shift in mindset and behaviour is what the market calls resilience. It means that decision-making must consider not only business fit and efficiency, but also how choices affect the organisation’s ability to withstand and recover from shocks.

As part of the critical infrastructure, our responsibility extends beyond the bank itself. We must safeguard continuity for our clients, maintain access to essential services and support the effective functioning of society. Resilience therefore connects commercial priorities with preparedness, ensuring that we can respond decisively while continuing to serve clients and society when circumstances change unexpectedly.

Banking resilience is societal resilience

Banks continue to play a critical role in the functioning of society and during periods of stress, continuity is critical. A resilient bank helps protect confidence, preserves access to essential services and supports the stability of the wider financial system.

This is why resilience has to be viewed beyond simply the balance sheet. Capital, liquidity and credit quality remain vital, but resilience depends also on operational capacity, reliable information, effective decision-making, and the ability to continue critical services during disruption. For a bank, preparedness is therefore both an organisational responsibility and a contribution to the resilience of the Netherlands and Europe.

Resilience as a strategic choice

Resilience is often discussed mainly through the language of risk appetite or mitigation, but the current environment requires a broader perspective. The fundamental question is not only how much risk the organisation is prepared to accept, but what capabilities it deliberately chooses to maintain so that it can continue operating when circumstances change.

True resilience begins where compliance is translated into practical capability.

This makes resilience a strategic choice. Decisions about technology architecture, service design, sourcing, staffing, data, recovery capacity and investment all shape the organisation’s ability to withstand disruption and to respond better to shock events. Resilience must therefore be considered alongside client value, strategic fit and efficiency. The organisation is choosing today how well it will be able to respond tomorrow and what are our priorities.

Digital and third-party resilience are key

The banking industry is increasingly digital and interconnected. Critical services depend on technology platforms, cloud services, software providers and specialised suppliers. While this brings efficiency and innovation, it also means that a disruption outside the bank can quickly affect the services on which clients rely.

Digital resilience therefore extends beyond protecting our own systems. It requires a clear view of end-to-end services, the technology and data that support them, and the third parties on which they depend. Prevention remains important, but no organisation can fully prevent every single cyberattack, outage or supplier failure. The key capabilities to contain an incident include maintaining priority services, being able to recover within acceptable timeframes and learn from what happened. These capabilities need to be tested across organisational boundaries, together with key suppliers rather than in isolation.

DORA is necessary, but not sufficient

The Digital Operational Resilience Act has made an important contribution by establishing a common regulatory foundation for ICT risk management, incident reporting, testing and third-party oversight. I welcome the discipline and consistency that DORA brings, but compliance with DORA is not the destination. Regulation sets an essential baseline, but a bank can meet formal requirements and still be insufficiently prepared if plans have not been tested realistically, dependencies are poorly understood or decision-making breaks down in a crisis. True resilience begins where compliance is translated into practical capability.

The objective is not to create additional barriers, but to help the organisation make informed choices.

Risk as a driver and enabler of resilience

Risk has a dual role in this agenda. First, it is a driver of resilience. By scanning the horizon, developing scenarios, challenging assumptions and identifying concentrations and dependencies, risk helps the organisation see where disruption may come from and where the consequences could be greatest.

Second, risk is an enabler. Resilience cannot be delivered by the second line alone; it depends on business, operations, technology, procurement, communications and external partners working together. Risk can help translate uncertainty into priorities, connect financial and non-financial perspectives, support proportionate investment choices and bring the right stakeholders together. The objective is not to create additional barriers, but to help the organisation make informed choices and act before weaknesses become crises.

In this way, risk moves beyond monitoring resilience to actively strengthening it. It creates direction, supports accountability and helps ensure that the bank is ready to continue serving clients, supporting employees and fulfilling its role in society under all conditions.

Capital allocation as a growth decision

Risk appetite guards growth in a controlled way through the defined boundaries; capital allocation turns those boundaries into choices. A resilient balance sheet creates options. The question is how those opportunities should be used, and what conditions should be attached.

A CRO may challenge whether capital is best used to expand existing portfolios, enter new markets, invest in transformation, strengthen resilience further or return capital to shareholders. Not all growth opportunities are equal. Some improve diversification and sustainable returns. Others lift short-term revenue but increase concentration risk or consume disproportionate capital and liquidity. The CRO’s role is to:

• bring the facts to the table,
• challenge assumptions and
• steer capital toward opportunities that create lasting value, while adhering to the defined risk appetite and profile.

This requires a strong risk culture. The three lines of defence model remains important but should not become a reason to stand apart from the business. Risk adds most value when it is:

• close enough to understand commercial choices
• independent enough to challenge them, and
• practical enough to help shape action on the risks that matter.

The risk function as an enabler of sustainable growth

This is where risk management becomes an enabler of sustainable growth. Instead of asking only, "Why should we do this?", the more valuable question is: "Under what conditions can we do this safely and sustainably?"

That does not mean lowering standards. It means being clear about the risks being taken, whether they are within appetite, adequately compensated, and supported by enough capital, liquidity and operational capacity. When those questions are answered with discipline and speed, risk becomes a source of direction rather than a brake on ambition.

Ultimately, resilience and growth are not opposing objectives. The most resilient organisations are often best positioned to grow because they have the financial strength, risk discipline, forward-looking insight and flexibility to take opportunities when they arise. For a CRO, the task is to ensure that de-risking creates not just a safer bank, but a clearer basis for better decisions: where to grow, how fast to grow, and under what conditions growth will remain sustainable.

Discuss the most pressing matters in risk management at RiskMinds – the largest gathering of CROs anywhere.