巴西企业风险管理职能扩张，中资机构合规架构需同步升级

Cristiane Silva Rogerio Vieira/Valor As geopolitical tensions rise, production fluctuates, and markets face new regulations, the chief risk officer (CRO) is taking on a prominent role at companies. In recent years, the position’s influence has expanded beyond workplace safety into finance, compliance, and information technology, driven by regulatory requirements, pressure to meet environmental, social, and governance (ESG) targets, and increased attention to protecting contracts and corporate data. In practice, experts interviewed by Valor said the executive’s task is to ensure that the company has the governance, capital, and control mechanisms needed to support business expansion—while minimizing the risk of problems along the way. According to a KPMG survey of more than 100 companies in Brazil, the share of businesses with a risk manager rose from 30% in 2020 to 41% in 2022 and 59% in 2024. Another survey by the consulting firm, based on data from 276 companies listed on Brazil’s B3 stock exchange and analyzed through May 2025, found that 80% of the country’s publicly traded companies have a department dedicated to risk management. Thaís Mendonça, managing partner for governance, risk, and compliance services at KPMG Brazil, said three factors are driving demand for these executives. The first is the “transformative power” of sound business practices, she said. “B3’s Novo Mercado Regulation [a set of corporate governance rules created by the Brazilian stock exchange] requires companies to have governance, risk, and compliance departments,” she said. “That creates a benchmark effect, prompting even companies that are not required [to comply with the rules] to establish such structures ‘out of conviction.’” The second factor, she said, is the growing complexity of business and the uncertainty surrounding decision-making amid technological disruption, international instability, cyberattacks, and regulatory and ESG requirements. “Most CEOs (72%) have already adjusted their growth strategies to address these interconnected challenges,” Mendonça said, citing KPMG’s “2025 CEO Outlook,” which surveyed 1,300 executives in 11 countries. “Knowing how to identify, prioritize, and manage risks has become one of the most sought-after leadership skills.” The third factor driving the growing presence of risk managers is companies’ need for a C-suite executive who can ensure that CEOs’ initiatives have adequate risk coverage. “Companies are looking for forward-thinking professionals capable of anticipating customer needs, preserving competitive advantages, and managing the risks associated with growth and innovation,” she said. “Risk managers are no longer compliance officers; they have become guardians of a company’s long-term viability.” That is the case for Cristiane Martins da Silva, executive director of risk management, compliance, and actuarial services at Sompo, an insurance company with 670 employees in Brazil. “Risk management has always been part of the insurance industry because it is at the heart of the business,” said Silva, who joined the company in 2021 and has held her current position since 2024. “But six years ago, when we began shifting our focus toward corporate and agribusiness insurance, we strengthened our governance structures, expanding the department’s role.” “Risk management is now seen not merely as a protective mechanism focused on controls, but as an essential component in supporting decisions, anticipating scenarios, and contributing to sustainable growth,” said Silva, who leads a team of 33 professionals. The department’s importance within the organizational structure is evident in recent developments. In 2024, Silva participated in a nearly three-month global leadership development program alongside company executives from countries including Japan and the United States. This year through July, the company held 11 training sessions on the subject for teams, while in 2025 the department was bolstered by hiring risk management superintendent Juliana Nascimento. “Our work is not limited to identifying situations that should be avoided. We also help the organization decide which risks are worth taking to achieve its objectives,” said Silva, who worked on Sompo’s agreement to acquire Fator Seguradora, announced in July. “In transactions of this kind [corporate acquisitions], we are involved from the initial assessment stages, identifying regulatory, financial, reputational, and integration risks.” Adriana Umeda, executive director of risk at Visa Brazil, said the department also plays a critical role in enabling corporate innovation. Umeda has held the position since 2023 and has worked at the electronic payments company for 22 years. “The role’s greatest challenge—and its greatest opportunity—is enabling new business models to grow safely and responsibly,” she said. Umeda, who reports to the regional risk leadership for Latin America and manages 17 employees, said her responsibilities include operational and financial contingencies, fraud prevention, and regulatory matters. “They also involve engagement with customers, partners, and regulators,” she said. Sônia Maria de Sá, director of risk and internal controls at Tupy, a Brazilian industrial technology multinational with 12,700 employees in the country, said a good risk manager must combine technical expertise, independent judgment, and strong communication skills. “The executive must understand the organization’s operations and regulatory environment, translating risks into useful information for decision-making.” Sá, who has more than 20 years of experience in governance, auditing, and business continuity in Brazil and abroad, joined Tupy last year, when the group established its risk and controls department. “The development of this corporate structure helped establish a common language around the subject within the company and strengthen integration among departments,” she said. As a result, she added, the company has increased its ability to assess vulnerabilities and opportunities aligned with its business strategies. In April, Tupy began operating a battery-recycling pilot plant in São Paulo. The initiative received approximately R$45 million in investment and is intended to help decarbonize the energy-storage battery supply chain. Translation: Todd Harkin