Ask a search engine how to get certified in risk management and you will get a pile of programs that sound interchangeable. They are not. Three credentials account for most of what U.S. employers mean when a job posting asks for a risk management certification — the ARM, the CRM, and the RIMS-CRMP — and each one proves a different thing. The ARM proves you studied the discipline. The CRM proves you went deep on the practice. The RIMS-CRMP proves you have already done the job and can pass an experience-gated certification exam. Which one is worth getting depends entirely on where you are standing.
First, the thing nobody tells you: there is no license
Risk manager is not a licensed occupation. No state issues a risk management license, and no credential on this page is legally required before an employer can hire you into a risk role. That is different from the insurance side of the business: selling, soliciting, or negotiating insurance requires a state producer license, which is a separate track with its own exams and continuing education.
So a risk management certification is not a permit. It is currency. Employers write designations into job postings because the letters are a fast screen for a body of knowledge they do not want to test in an interview. The credential does not replace experience — one of the three below will not even let you sit for it without experience — but it decides whose résumé gets read as “risk professional” and whose gets read as “adjacent.”
The three credentials, side by side
| ARM | CRM | RIMS-CRMP | |
|---|---|---|---|
| Full name | Associate in Risk Management | Certified Risk Manager | RIMS-Certified Risk Management Professional |
| Run by | The Institutes | Risk & Insurance Education Alliance | RIMS — the Risk Management Society |
| What it is | Study designation: 3 courses plus ethics | Study designation: 5 courses with essay exams | Certification: eligibility gate plus a proctored exam |
| Experience required | None | None stated — aimed at working practitioners | Yes — degree-and-experience paths, or 7 years in risk management with no degree |
| Typical timeline | 9–12 months | Five 16-hour courses, finished within 5 calendar years | Exam-based; certification renews every 2 years |
| Renewal burden | None after earning | 16 hours of update coursework every year | Continuing education on a 2-year cycle |
ARM: the learn-the-discipline credential
The Associate in Risk Management, from The Institutes, is the standard first credential in the field and the one most people asking this question should start with. It is three courses, taken online: ARM 400, Risk in an Evolving World; ARM 401, Holistically Assessing Risk; and ARM 402, Successfully Treating Risk — plus The Institutes’ ethics course, which is required across its designations. The Institutes puts typical completion at 9 to 12 months, with each course averaging six to eight weeks and exams offered virtually in 60-day windows.
The curriculum follows the discipline in order: what risk is and how organizations govern it, how to identify and analyze it (including the data and modeling side), and how to treat it — insurance, alternative risk financing, and everything that is not insurance. That sequence is why employers like it on early-career résumés: an ARM holder has at least been exposed to the whole process, not just the insurance-buying slice of it.
The ARM also compounds. The Institutes’ credits feed its other designations, and RIMS counts holding the ARM or the Canadian CRM toward the experience requirement for the RIMS-CRMP — two years of credit, which matters below.
CRM: the practitioner-depth credential
The Certified Risk Manager designation, run by the Risk & Insurance Education Alliance, is built around the five steps of the risk management process: identifying exposures, analyzing risk, controlling it, financing it, and administering the program. It is five courses of 16 hours each, and it is not a multiple-choice stroll — each course ends in a two-and-a-half-hour essay exam, and you need at least 70% on each to pass. All five must be completed within five calendar years.
The CRM also carries a standing obligation the ARM does not: an annual update requirement of 16 hours of supplementary coursework every year to keep the designation current. Read that as a feature or a cost depending on your temperament. Employers who know the designation know the holder is still studying; holders know the meter is always running. The CRM skews toward practicing risk managers, agents, and brokers who manage risk programs day to day and want the depth credential in the process itself, including claims management and multinational risk.
RIMS-CRMP: the prove-it credential
The RIMS-Certified Risk Management Professional is not a course of study. It is a certification, run by RIMS, and its defining feature is the gate in front of the exam. Eligibility runs on degree-and-experience paths: a bachelor’s degree in risk management plus one year of full-time risk management work; the same degree in another field plus three years; final-year risk management students may sit early; or, with no degree, seven years of risk management experience. Holding the ARM or Canadian CRM counts toward two years of that experience.
The exam itself is 120 multiple-choice questions — 100 scored, 20 pretest — in two hours, with a passing score of 71%. RIMS publishes its exam fee at $375 for members and $525 for non-members, including the application fee; confirm the current figure with RIMS before you budget, because fee schedules move. The certification is awarded for two years at a time and renews with continuing education, and it is built around five competencies: analyzing the business model, designing organizational risk strategies, implementing the risk process, developing organizational risk competency, and supporting decision making.
Because of the gate, the CRMP signals something the other two cannot: verified time in the chair. That is also why it is the wrong first move for most people reading this page — if you cannot yet document the experience, the credential cannot be your next step no matter how well you would test.
What about the CPCU?
The Chartered Property Casualty Underwriter, also from The Institutes, will come up in any search on insurance credentials, and it deserves a sentence of orientation. The CPCU is the broad, deep property-casualty designation — a longer multi-course program aimed at underwriting, claims, and brokerage depth across the whole P&C business. Brokers and carrier people pair it with the ARM constantly. It is not a risk-management credential as such; it is the industry’s general scholarship, and for a corporate risk-management track the ARM-to-CRMP line is the more direct route.
The sequence that actually works
If you are entering the field or moving into a first risk role, start with the ARM. It has no experience gate, it teaches the discipline in the order the discipline works, it finishes in about a year, and it banks credit toward everything after it.
If you are already practicing — running programs, placing coverage, managing claims — the CRM is the depth move, and its essay exams and annual update will suit you if you learn by working problems rather than by testing well.
If you have the years and want the credential that certifies them, the RIMS-CRMP is the capstone. Take it when your experience file is already strong enough that the eligibility math is easy, and let the ARM credits shorten the wait if you hold them.
Whichever you choose, keep the honest limit in view: a designation gets your résumé sorted into the right pile. The interview still goes to the person who can talk about a loss they prevented, a renewal they restructured, or a risk register they actually maintain. The credential and the record are complements, not substitutes — and the field’s own framework for that record is the enterprise risk management discipline the ARM teaches first.
Frequently asked questions
Do you need a certification to work as a risk manager?
No. Risk manager is not a licensed occupation and no credential is legally required to hold the job. Certifications matter because employers screen for them — postings name the ARM, CRM, and RIMS-CRMP because the letters stand for a verified body of knowledge.
Which risk management certification is best for beginners?
The ARM. It has no experience prerequisite, it is fully online, and its three courses cover the discipline end to end — risk governance, assessment, and treatment — in 9 to 12 months.
How long does the ARM take?
The Institutes puts typical completion at 9 to 12 months: three courses (ARM 400, 401, 402) plus a required ethics course, with virtual exams in 60-day windows.
What is the difference between the ARM and the RIMS-CRMP?
The ARM is a study designation — pass the courses, earn the letters, no experience required and no renewal. The RIMS-CRMP is a certification — you must first qualify on degree and experience (up to seven years without a degree), then pass a 120-question exam, and renew every two years with continuing education. Holding the ARM counts toward two years of the CRMP’s experience requirement.
Does a risk management certification replace an insurance license?
No. They are separate tracks. Certification is voluntary professional education; selling or negotiating insurance requires a state producer license regardless of what designations you hold.
The rest of the careers cluster
Start where you are. If you are deciding whether the chair itself fits, read what a risk manager actually does — the four versions of the job and the week each one really spends. If you already know the destination and need the route, risk management training lays out the five forms the learning takes, from degree programs to the claims desk, and how to sequence them with the credentials above.