Stephanie Richard has spent nearly three decades helping guide
Now, as chief risk officer since November 2024, she wants to redefine how the role is perceived.
"It's thinking about how to bring clarity to big, ambiguous problems," she said. "It's helping connect dots across the organization."
As threats from cyberattacks, novel AI models and geopolitical uncertainty loom large, Richard has had to resist the temptation to add more complexity to the institution's systems over the last year, instead opting to simplify. She led a sweeping revamp of Ally's enterprise risk framework, reducing nearly 400 board-level risk measures to roughly 100 strategic guardrails. The task involved breaking down years of ingrained routines, processes and reporting in order to see the bigger picture, she said.
Simplifying the framework has accelerated decision-making by shifting risk committees from reporting forums to decision forums, allowing executives and the board to focus on the issues most likely to affect the bank.
Ally's CEO Michael Rhodes called Richard "indispensable ... not just as a guardian against downside, but as a force multiplier for strategy, resilience, culture and long-term value creation."
According to Ally, Richard's work played a crucial hand in increasing its CET1 capital ratio by 120 basis points, cutting credit losses by 15%, materially reducing interest-rate risk and growing earnings by 62%. This is proof that disciplined risk management and business growth reinforce one another, Richard argued.
In its financial results released
Richard also cited the bank's policies governing AI as a good example of the new risk framework in action.
"[We asked] how can we make AI an accelerant to our transformation, not something that we have to control for," she said.
Looking ahead, she believes the industry's biggest blind spot will be concentration and dependency risk as organizations become increasingly reliant on AI-driven decision-making.
In the coming year, Richard has set her sights on solidifying the importance of the CRO role as a strategic advisor to the C-suite and board. "It takes a lot of courage to ask the tough questions," she said. "You can challenge other people and still build relationships. You can be direct and still be collaborative."
Richard said that continuing to develop the talent pipeline of future leaders in risk is another priority. In 2025, all five executive appointments on her team were internally promoted. When she became CRO there wasn't a single woman leader on the risk management team. Today, there are three.
"I'm at a point where it's not really about me. It's really more about developing others," she said.
