Day-to-day operating brief
What Risk Manager work looks like in practice
A Risk Manager maintains the organisation's risk framework, facilitates assessments and reports exposure across strategic, operational, financial and client activities. The role challenges owners and coordinates scenarios, incidents and business continuity but does not accept every risk personally. Terms should define reporting line, access, methodology, committee work, confidential registers, assurance interfaces, crisis duties and delegated acceptance thresholds. Risk assessments should distinguish inherent exposure, existing controls, residual position and the person accepting any tolerance breach. Aggregated scoring must not obscure a low-frequency event with severe consequences. Challenge should be documented constructively, including evidence requested and management response, while the business owner retains the decision. Incident learning needs accountable actions and due dates; closing a committee paper is not equivalent to verifying that a control now operates effectively. Board reporting should explain trend, concentration and control confidence rather than compress every issue into a colour. Where evidence is incomplete, the report should state uncertainty and planned verification instead of presenting managerial reassurance as tested fact.
Individually written and reviewed against the maintained role record.