The title hides four different jobs. “Risk manager” can mean the person who buys insurance for a hospital system, the safety-and-claims lead at a school district, a loss-control consultant who inspects other people’s buildings for a carrier, or the risk advisor inside a brokerage who designs programs for clients. The work rhymes across all four — find what can hurt the organization, decide what to do about it, finance what remains — but the days look nothing alike. This page is about the role itself: what risk managers actually do all week, what they do not do, and how people get into the chair.
The job in one paragraph
A risk manager owns an organization’s losses before they happen. They identify exposures — the building that can burn, the contract that quietly transfers someone else’s negligence, the driver fleet, the data, the key supplier — assess how likely and how expensive each one is, and then work the four classic moves: avoid the activity, control it down, retain it deliberately, or transfer it through insurance. Then they run the machinery that makes the decision real: the insurance program, the claims process, the certificates file, the incident reports, and the annual argument to leadership about what the risk actually cost. When the discipline is framed at enterprise scale, it becomes the subject of this hub’s guide to enterprise risk management; the risk manager is the person who runs it at human scale.
The four chairs
The corporate risk manager works inside a company large enough to employ one — manufacturers, retailers, hospital systems, logistics firms. They report into finance, legal, or operations, manage the broker relationship, own the renewal calendar, and answer for the total cost of risk. The public-entity risk manager does the same work for a city, county, school district, or transit authority, often inside a risk pool shared with other public bodies, and with public-records and board politics layered on top. The carrier-side risk control consultant — loss control — visits insureds’ sites, writes recommendations, and reports hazards back to underwriting; it is the most field-heavy version of the job. The broker-side risk advisor sells no policies personally but designs programs, reviews contracts, and runs claims advocacy for a book of clients. Most careers touch two or three of these chairs; the skills transfer cleanly between them.
The week, concretely
Monday is the incident inbox. Someone was hurt Friday, a forklift tagged a rack, a customer slipped in a store. The risk manager makes sure each event is reported properly, preserved on camera before the footage overwrites, and handed to the right carrier or third-party administrator with the facts straight. Midweek is contracts and certificates. Every new vendor, lease, and construction project arrives with insurance requirements — limits, additional insured status, waivers of subrogation — and somebody has to check that the certificates of insurance actually match what the contract demanded, and chase the ones that do not. The renewal is always coming. Property schedules, vehicle lists, payroll by class code, loss runs: the data an underwriter prices is assembled months ahead, and the risk manager’s craft is presenting the organization’s risk honestly and well. And underneath the calendar sits the slow work — walking sites, reading incident patterns out of the claims data, and getting one fix funded before the pattern becomes the loss everyone remembers.
What the job is not
Risk managers buy insurance; they do not sell it. The broker sells; the risk manager is the professional on the buying side of the table, which is precisely why the role exists — somebody inside the organization has to be able to read a policy the way the carrier wrote it. They also do not run safety alone: safety professionals own the programs, and the risk manager owns the financing, the claims, and the argument that connects the two. And they are not the legal department — they flag contract risk and manage insured litigation alongside counsel, but the legal calls belong to lawyers. Candidates who understand those boundaries interview better than candidates who promise everything.
How people get in
There is no single door, but the paths repeat. Some arrive with a risk management and insurance degree — long-running programs exist at universities including the University of Georgia and Florida State — and step into analyst roles. More arrive sideways: from claims desks, where they learned what losses actually cost; from underwriting, where they learned how risk gets priced; from loss control and safety, where they learned what hazards look like in person; from brokerage service teams, where they learned the buyer’s calendar. The certifications that mark the progression — ARM, CRM, RIMS-CRMP, and when they are worth taking — are laid out in this hub’s guide to risk management certification, and the structured learning behind them is covered in its companion on risk management training.
What employers actually screen for
Read the postings and a pattern emerges. Senior roles commonly name a designation — ARM, CRM, or RIMS-CRMP appear again and again — alongside years spent inside one of the feeder jobs. But the skills that decide interviews are plainer: can you read a contract’s insurance exhibit and spot the gap; can you take a loss run apart in a spreadsheet and tell the story it contains; can you write two pages an executive will finish; can you stay useful in the first ugly hour after a serious incident. The designation gets the résumé read. Those four abilities get the job.
Frequently asked questions
What does a risk manager do all day?
Manages the machinery around loss: incident intake and claims reporting, contract and certificate review, site inspections, the insurance renewal calendar, and analysis of what past losses are teaching. The mix shifts by employer — carrier-side consultants spend their days in the field; corporate risk managers spend theirs in meetings, documents, and data.
Is a risk manager the same as a safety manager?
No — they are partners, not synonyms. Safety managers build and run prevention programs. Risk managers own the wider portfolio: insurance buying, claims, contract risk transfer, and the financial picture of loss. In small organizations one person may wear both hats; in larger ones the roles are separate and work closely.
Do you need a degree to become a risk manager?
Not strictly. Many risk managers entered through claims, underwriting, loss control, or brokerage service without a risk-specific degree. University risk management and insurance programs are the most direct route, and designations such as the ARM or CRM are how experienced entrants formalize their knowledge — but experience in a feeder role is the common denominator.
Do risk managers need certification?
Rarely by law, often in practice. No regulator licenses the role, but senior postings commonly name the ARM, CRM, or RIMS-CRMP, and the credentials structure the knowledge the job assumes. Which one fits depends on your seat and stage — the certification guide on this hub walks the landscape.