Risk manager job description: the three jobs that share the title, ten duties and the authority question

Appoint a risk manager without settling what they may stop, and you have hired someone to write a register that everyone reads and nobody acts on. That is the most common failure of the role, and it happens before the first day.

This article sets out a risk management manager job description: the three jobs that share the title, ten duties built on the risk cycle, risk appetite, reporting, the authority question, how the role is measured and a template.

Risk work runs on stages, owners and dates that nobody can find. See how New Dynamics workflows let you define your own, with a completion view instead of a spreadsheet.

Three jobs, one title

• Enterprise or corporate risk. Owns the risk framework, the register, the appetite statement and the reporting to the board. Generalist, cross-departmental, heavy on convening.
• Financial or market risk. Quantitative. O*NET's Financial Risk Specialists conduct "statistical analyses to quantify risk, using statistical analysis software or econometric models", develop "risk-assessment models or methodologies", devise "scenario analyses reflecting possible severe market events", and analyse "new legislation to determine impact on risk exposure".
• Operational, and health and safety. Hazards, controls, incidents, business continuity and insurance, anchored in the legal duties every employer has.

Most disappointments come from advertising one and hiring for another. Name the version in the title, or in the first line of the advert.

The risk cycle, which is where the duties come from

Prospects' risk manager profile describes the work as a process rather than a list: plan, design and implement "an overall risk management process for the organisation", then make risk assessments, "analysing risks as well as identifying, describing and estimating the risks affecting the business", then evaluate risk by "comparing estimated risks with criteria established by the organisation such as costs, legal requirements and environmental factors".

Four stages, repeating:

1. Identify. What could go wrong, from the people who would know first.
2. Analyse and estimate. How likely, how bad, and how confident are we in that estimate.
3. Evaluate and decide. Against the organisation's own criteria: accept, treat, transfer or avoid.
4. Treat, monitor and report. Controls with owners and dates, then evidence that they are still working.

A register that never reaches stage four is a list of worries.

Ten duties

1. Design and run the risk process, including the register, the assessment method and the cycle above.
2. Assess risks with the people who own the work, not from a desk.
3. Evaluate against agreed criteria, including cost, legal requirements and environmental factors, and review "previous handling of risks".
4. Establish and quantify risk appetite ("the level of risk they are prepared to accept") with the board rather than for it.
5. Report to three audiences, covered below.
6. Arrange treatment and transfer. Prospects lists carrying out processes such as purchasing insurance, implementing health and safety measures and creating business continuity plans.
7. Keep policy current. Review risk policies "regularly to ensure they are compliant with relevant new legislation", and analyse new legislation for its effect on exposure.
8. Audit and assure. Conduct "audits of policy and compliance to standards, including liaison with internal and external auditors". Our audit manager post covers the assurance side of the same relationship.
9. Plan for the bad day. Develop "contingency plans to deal with emergencies", and test them.
10. Build risk awareness, providing "support, education and training to staff", which is how risks get reported before they become incidents.

Risk appetite, and who owns it

Risk appetite is the sentence that makes every other decision easier, and it belongs to the board. The risk manager's job is to draft it, quantify it and make it specific enough to use: what level of loss, disruption, regulatory attention or reputational damage the organisation will accept, and in which areas it will accept none.

A useful test: if the appetite statement would not change a real decision in the next quarter, it is decoration.

Reporting to three audiences

The profile is unusually precise here, and it is worth following exactly. Report risk "appropriately according to the audience":

• To the board of directors, "so they understand the most significant risks", a short list, in business terms, with what is being done.
• To business heads, "to ensure they are aware of risks relevant to their parts of the business", their risks, their controls, their dates.
• To individuals, "to understand their accountability for individual risks", the control owner needs to know they own it.

One report for all three audiences is the standard mistake. It is too long for the board and too vague for the control owner.

The authority question

Settle four lines before advertising:

1. What the risk manager decides alone. Usually the method, the register, the scoring and the reporting.
2. What they may require. A risk assessment before a change, a control before a launch, or evidence that a control still works.
3. What they may only recommend, and to whom.
4. How an unresolved disagreement escalates, and to which committee or director.

Without line four, the role loses every argument with an operational manager under deadline pressure, which is exactly when risk decisions matter. Risk work is also change work: our change management guide covers taking people with you rather than issuing findings.

The floor every employer stands on

Whatever version of the role you are hiring, health and safety risk is not optional. HSE's guidance on managing risks and risk assessment at work is plain: "as an employer, you're required by law to protect your employees, and others, from harm", and under the Management of Health and Safety at Work Regulations 1999 the minimum is to "identify what could cause injury or illness in your business (hazards)", "decide how likely it is that someone could be harmed and how seriously (the risk)", and "take action to eliminate the hazard, or if this isn't possible, control the risk".

HSE also notes that "assessing risk is just one part of the overall process used to control risks in your workplace", the same point the cycle above makes. Say in the job description whether this duty sits with the risk manager, with a separate health and safety lead, or with line managers supported by both. This is general information rather than legal advice, and the duty is the employer's.

What the job description must state

• Which risk. Enterprise, financial, operational, health and safety, information, project, or a named combination.
• The authority lines, as above.
• The reporting route: to whom, how often, and to which committee.
• The scope: sites, entities, countries, and whether suppliers are included.
• Whether the role owns insurance and business continuity, which are often assumed and rarely stated.

How the role is measured

• Risks with a named owner and a current control date, rather than the number of risks logged.
• Overdue actions, and whether they are chased or simply re-dated.
• Near misses and incidents reported, where a rise usually means people trust the process rather than that things got worse.
• Time from identification to decision, which is where risk processes silently fail.
• Evidence that controls still work, sampled rather than assumed.
• Board and management use: whether a risk report changed a decision this year.

Avoid measuring register size or the number of assessments completed. Both reward paperwork and neither tells you whether the organisation is safer.

A risk manager job description template

Job title: Risk manager [enterprise / financial / operational]

Reports to: [director / risk committee]

Scope: [entities, sites, countries], [suppliers in or out]

Purpose: Own the process by which this organisation identifies, evaluates, treats and monitors risk, and make sure the right people know what they are accountable for.

Responsibilities

• Design, run and improve the risk management process and register.
• Facilitate risk assessments with the teams that own the work.
• Evaluate risks against the organisation's agreed criteria.
• Draft and maintain the risk appetite statement with the board.
• Report to the board, business heads and control owners, in the form each needs.
• Arrange or advise on insurance, business continuity and contingency planning.
• Review risk policies against new legislation and standards.
• Conduct compliance audits and liaise with internal and external auditors.
• Provide risk training and support across the organisation.
• Escalate unresolved risks through [named route].

Decides alone: the method, the register, scoring and reporting format.

May require: [a risk assessment before a change, evidence of control effectiveness].

Escalation: [named committee or director], within [period].

Frequently asked questions

What does a risk manager do?

Advises an organisation on risks to its profitability, safety, security or existence, and runs the process that handles them: designing the risk framework, assessing risks with the teams that own the work, evaluating them against agreed criteria, arranging treatment such as controls, insurance and continuity plans, reporting to the board and business heads, auditing compliance and training staff.

What are the main risk management duties?

Identifying risks, analysing and estimating them, evaluating them against the organisation's criteria, deciding whether to accept, treat, transfer or avoid each one, putting controls in place with named owners and dates, monitoring whether those controls still work, and reporting appropriately to the board, to business heads and to individual control owners.

What is the difference between a risk manager and a compliance officer?

A compliance officer is concerned with meeting specific obligations, law, regulation, standards and internal policy. A risk manager is concerned with uncertainty of any kind, including risks nobody regulates: a single supplier, a key person, a fragile system. The two overlap on regulatory risk and should share a register rather than keep two.

What is risk appetite?

The level of risk an organisation is prepared to accept, expressed clearly enough to change decisions. The risk manager drafts and quantifies it; the board owns it. If the statement would not alter a real decision in the coming quarter, it is not specific enough.

Does a risk manager handle health and safety?

Sometimes, and the job description should say. Every employer has duties under health and safety law to identify hazards, assess how likely and how serious harm would be, and eliminate or control the risk. Whether the risk manager owns that, a dedicated health and safety lead does, or line managers do with support, is a structural choice to state rather than assume.

How should a risk manager be measured?

On risks with named owners and current control dates, overdue actions, near misses and incidents reported, the time from identifying a risk to deciding what to do about it, sampled evidence that controls still work, and whether risk reporting actually changed a decision. Counting entries in the register rewards paperwork.

Your next step: write the authority lines first

1. Name which risk the role owns, in the title or the first line.
2. Write what the risk manager decides, what they may require and what they may only recommend.
3. Name the escalation route and the committee that hears it.
4. Agree the three reports (board, business heads, control owners) before the first register review.

For running risk change as change rather than as findings, read and download our change management guide. The guide is free to read, and the PDF uses our short download form.

Want risk actions with owners, dates and a completion view instead of a spreadsheet nobody opens? Book a New Dynamics demo and bring your current risk register. You can also email contact@new-dynamics.com.