Guides
What a risk manager does, and when a business needs one
What a risk manager does: find exposures, decide what to keep or insure, run the insurance program and claims, and when a business should hire one.
A risk manager finds the ways an organization can lose money or capacity, decides which risks to avoid, reduce, keep or transfer, and then runs the machinery that carries out those decisions: the insurance program, deductible and retention levels, claims, contract requirements, loss control and continuity plans. In a large company this is a department. In a smaller one it is a part of the CFO's, controller's or owner's job, with a broker doing much of the technical work.
The core duties
| Duty | What it looks like in practice |
|---|---|
| Identify and measure exposures | Site visits, a risk register, review of contracts, fleet, payroll and revenue data, and loss history |
| Decide how to finance each risk | Choose deductibles and self-insured retentions, buy limits, consider a captive, set a budget for retained losses |
| Run the insurance program | Prepare renewal submissions, manage the broker, negotiate with underwriters, review policy forms and endorsements, keep schedules of values and driver lists current |
| Manage claims | Report claims, oversee adjusters and third-party administrators, review reserves, direct strategy on large or litigated losses |
| Drive loss control | Work with safety, operations and facilities on the causes of claims; support carrier loss control visits |
| Control contracts | Review indemnity and insurance clauses, set vendor requirements, track certificates (see contractual risk transfer: shifting liability by contract and insurance) |
| Plan for disruption | Business continuity, crisis response and supplier risk |
| Report | Total cost of risk, loss trends and key exposures to the CFO, audit committee or board |
The decision about whether to transfer or keep a risk is the intellectual center of the job. risk transfer vs retention: avoid, reduce, transfer or retain sets out the four responses, and the deductible and retention break-even calculator tests how much more retention pays off against the premium credit.
Insurance buyer versus enterprise risk manager
Two different jobs share the title. The traditional risk manager is an insurance and claims specialist, closely tied to finance and the broker. The enterprise risk manager looks across strategy, operations, compliance, technology and finance, and may report to a chief risk officer or the CFO. Frameworks used by the second kind include ISO 31000 (the international risk management guidelines) and the COSO enterprise risk management framework. See Enterprise risk management (ERM) explained. In practice, mid-sized companies ask one person to do both.
Whatever the title, measuring risk in dollars is the discipline: what a loss would cost, how often, and how much the organization pays in the whole cycle of premiums, retained losses, administration and the cost of controls. The total cost of risk metric and the Total cost of risk (TCOR) calculator do that arithmetic.
What the agenda looks like in 2026
The Allianz Risk Barometer 2026 surveyed 3,338 risk management experts from almost 100 countries and territories. Cyber incidents ranked first (42 percent of respondents), artificial intelligence second (32 percent, up from tenth) and business interruption, including supply chain disruption, third (29 percent), according to Allianz. Respondents could choose up to three risks, so the shares do not add to 100 percent. These are rankings of what risk professionals worry about, not loss data, but they show what fills a risk manager's year: cyber controls and coverage, AI governance, supplier dependence, regulation and catastrophe exposure.
The annual cycle
Insurance risk managers run a calendar. Most of it centers on renewal.
- 120 to 150 days before renewal: gather exposure data (payroll, revenue, vehicles, values, locations), claims updates and loss runs. Decide strategy with the broker: stay, remarket or restructure.
- 90 to 120 days: build the submission, review the prior year's coverage gaps and contract requirements, and decide on retentions.
- 60 to 90 days: the broker markets the program, underwriters meet management, and quotes arrive. See how to negotiate a business insurance renewal.
- 30 days: compare options, check form changes and exclusions, pick structure and bind.
- After binding: issue certificates, update the program summary, share it with operations, finance and the lenders, and handle premium audits.
- All year: claims reviews, safety committee, vendor and contract checks, business continuity testing and a mid-year check on exposure changes.
The business insurance renewal: a 90-day checklist covers the renewal in more detail.
Who the risk manager works with
- The broker. Placement, market access, benchmarking, claims advocacy and analytics. The relationship can be a partnership or a source of conflict, since brokers are paid by commission, fees or both (how commercial insurance brokers get paid).
- Underwriters and loss control engineers. Who need accurate data and see site conditions.
- Claims professionals and third-party administrators. Who handle the daily work on retained claims.
- Legal. Contracts, coverage disputes, litigation and regulatory matters.
- Finance. Reserves for retained losses, collateral, tax, lender covenants and budgets.
- HR, safety and operations. Workers' comp, return-to-work and the causes of injuries.
- IT and security. Cyber controls the underwriters ask about.
Skills and credentials
Risk managers come from brokerage, underwriting, claims, finance, audit and operations. Common designations are the RIMS-CRMP from RIMS, the Risk and Insurance Management Society (RIMS), and the ARM and CPCU designations from The Institutes. What employers care about more than letters is judgment under uncertainty, comfort with policy language, and the ability to explain financial trade-offs to executives who do not read policies. See careers in commercial insurance: underwriter, broker, adjuster for broader career routes.
Do you need a risk manager?
Signs that someone should own risk and insurance formally:
- Operations in several states or countries, or multiple locations with large values.
- Retentions or deductibles big enough that the company funds meaningful losses itself, or interest in a captive (what is a captive insurance company and how does it work?).
- Contracts that demand specific insurance, with certificates to issue and receive.
- Claims frequency or severity that moves earnings.
- A board, lender or investor asking for risk reports.
The options short of a full-time hire are a part-time or fractional risk manager, a risk consultant, a larger role for a finance leader with a broker's analytics, or a loss control and claims advocacy contract. Smaller businesses can follow risk management for small businesses: a practical framework without a title. Watch for one trap: relying on the broker for risk decisions that need an independent internal voice, such as how much retention the company can bear.
A hypothetical first year
Say a 300-employee regional distributor names its controller as risk manager. In the first 90 days she inventories the policies, pulls five years of loss runs and finds that workers' comp strains and forklift incidents account for most of the claims cost. She meets the safety manager, sets two targets, and asks the broker for a retention analysis. In the second quarter she reviews 40 vendor contracts and finds that half lack insurance requirements. Before renewal she assembles a submission with exposure data and a loss narrative, and negotiates a higher deductible on auto in exchange for a premium credit she has tested against the company's cash position. None of these figures are real; they illustrate how the job's pieces connect.
Key takeaways
- A risk manager's job is to identify exposures, decide what to retain or transfer, run the insurance program and claims, and report the cost of risk to management.
- Insurance risk management and enterprise risk management overlap; many mid-sized companies need one person to cover both.
- The work follows an annual renewal cycle starting four to five months before expiration, with year-round claims, contract and loss control work.
- Allianz's 2026 Risk Barometer ranks cyber, AI and business interruption as the top concerns among 3,338 risk experts.
- Companies without a full-time risk manager can assign the role to finance, use a fractional professional, and lean on a broker for technical work while keeping the key decisions in-house.