Risk manager: role, responsibilities and tools

The risk manager helps management understand and control all the risks the company faces. They identify them with business units, assess them, build the risk map, monitor treatment plans and report to the audit or risk committee. Cyber risk is one of them, and has become one of the most closely watched.

The role varies widely with company size and sector. This guide describes its core, the method it relies on, how it works with the CISO, and what public sources say about pay in France.

The risk manager leads enterprise risk management: everything an organisation does to spot what could stop it reaching its objectives, decide what it accepts and organise the reduction of the rest. The scope is cross-functional: strategic, financial, operational, legal, reputational, environmental and digital risks.

The job profile published by Apec, the French executive employment agency, lists several titles for the role: enterprise risk manager, risk and insurance manager, risk and compliance manager, chief risk officer in large groups. In banking and insurance, the role has a strong regulatory and financial flavour (credit, market and liquidity risk); this guide focuses on the role in companies and public organisations.

According to Apec, the role covers six groups of responsibilities:

• Identifying and ranking risks, and opportunities, through workshops with business units and process analysis.
• Assessing risks and building the risk map, often shown as a likelihood and impact matrix.
• Building and monitoring the control plan and the risk register, with owners and deadlines.
• Preparing for continuity: business continuity plans and emergency plans.
• Spreading a risk culture through a network of correspondents, and tracking legal and regulatory changes.
• Reporting to the audit or risk committee and managing relations with regulators.

In many companies the risk manager also runs the insurance programme: transferring part of the risk to an insurer is one of the treatment options, including for cyber risk.

The international reference is ISO 31000:2018, which provides guidelines for managing risk in any organisation. It is not certifiable: it is a good-practice framework. It has three parts: principles (risk management that is integrated, structured, customised, inclusive, dynamic…), a framework driven by leadership commitment, and a process, which the diagram below follows on an example.

Specialised methods follow the same process. ISO 27005 applies it to information security, and ANSSI's EBIOS Risk Manager method adapts it to digital risk. The other major reference in the field is COSO ERM, published by COSO, the body behind the internal control framework of the same name. Either way, the key is the same: common criteria (impact scales, risk appetite) set by management so that very different risks can be compared.

Both roles deal with risk, but not at the same level. The CISO is the information security expert: they carry out cyber risk analyses and lead protective measures. The risk manager places that risk among all the others and helps management arbitrate.

French authorities encourage the two to work together. In 2019, ANSSI and AMRAE (the French risk managers' association) jointly published the guide "Controlling the digital risk: the trust advantage", aimed at executives and risk managers. Its message, as ANSSI's press release puts it: digital risk is a strategic risk to be handled at the highest level, through a progressive fifteen-step approach. The NIS 2 Directive points the same way: its Article 21 requires risk management measures based on an "all-hazards" approach.

In practice, three rules avoid misunderstandings: cyber risk appears on the company risk map with the same impact scales as other risks; major cyber scenarios are built with the CISO; and cyber indicators presented to management go through a shared dashboard.

Apec describes a master's-level profile (university, engineering or business school) in finance, statistics, risk control or a related field, and notes that at least five years of risk management experience is often required. Expected skills combine:

• a technical base: economic and financial analysis, statistical models, knowledge of regulation, project and change management;
• interpersonal skills: teaching, persuasion, writing, a view that is both strategic and operational;
• digital literacy, increasingly essential to discuss cyber scenarios with the CISO and IT.

AMRAE leads the professional community in France and offers specialised training.

Figures published online vary widely and rarely explain their method. The most solid source is Apec's job profile, based on published job ads: 80% of salaries offered fall between €36,000 and €65,000 gross per year, variable pay included, with an average of €50,000.

These figures describe risk manager roles; chief risk officer positions in large groups or banks follow different scales. As for the CISO, company size, sector and regulatory exposure weigh heavily.

A risk manager's tools serve three purposes: recording (risk register, risk map), tracking (control plans, owners, deadlines, indicators) and reporting (reports for the audit committee, management and insurers). Many start with a spreadsheet, which quickly becomes hard to maintain as contributors multiply and the history of decisions must be kept.

For cyber, the challenge is linking the CISO's analyses to the overall risk map without re-keying. A shared governance, risk and compliance approach tracks risks, controls, action plans and supplier risks in one place.

Going further: Phinasoft's risk analysis module supports cyber risk analyses (ANSSI-certified EBIOS RM, ISO 27005 or your own method) and action plan tracking.