Risk Manager
Written by Justin Goodman, CIC, CISC, CLCS, CEO and Co-Founder, Total CSR
Published: October 6, 2026 · Last reviewed: October 6, 2026
In plain language: A risk manager is the person inside a company whose job is to spot things that could cause financial loss and decide what to do about them, whether that means fixing a hazard, buying insurance, or setting aside money to cover a future claim.
Technical definition: A risk manager is a corporate professional who identifies, measures, and controls an organization's loss exposures through a combination of risk avoidance, loss control, risk retention, and risk transfer, including structuring insurance programs, negotiating terms with brokers, and overseeing claims.
Risk Manager at a Glance
| Attribute | Detail |
|---|---|
| Also known as | Risk management professional, corporate risk manager, director of risk management |
| Category | Insurance and risk management role |
| Lines of business | Commercial General Liability, Workers' Compensation, Property, Umbrella and Excess Liability |
| Industries most affected | Construction, manufacturing, healthcare, higher education, municipal government |
| Who bears the risk | The organization employing the risk manager, often through a mix of insurance and self-funded retentions |
| Common solution | Blended programs using self-insured retentions, captives, loss control, and traditional insurance transfer |
| Also interacts with | Insurance brokers, third-party administrators, underwriters, legal counsel, safety directors |
Key Takeaways
- A risk manager is the internal professional responsible for identifying and controlling a company's exposure to financial loss.
- Agencies and brokers who work with risk managers deal with a more technical buyer who evaluates coverage structure, not just price.
- A common misunderstanding is treating a risk manager purely as an insurance buyer rather than as a decision-maker who may prefer self-insurance or retention over transfer.
- Agencies build stronger relationships with risk managers by bringing data-driven loss analysis and contract review to the table, not just renewal quotes.
What Is a Risk Manager in Insurance?
A risk manager is a specialist employed by a business, nonprofit, or government entity to protect the organization's assets, operations, and balance sheet from the financial impact of accidents, lawsuits, natural disasters, and other unplanned events. The role exists because insurance alone rarely solves every exposure a complex organization faces. A risk manager evaluates whether a given exposure should be avoided, controlled through safety programs, retained through a deductible or self-insured retention, or transferred to an insurance carrier.
Large organizations often employ a dedicated risk manager or an entire risk management department, while smaller companies may assign the function to a CFO, HR director, or operations leader. The role draws on finance, law, and engineering concepts, because effective risk management requires understanding contract language, claims data, and physical hazards at the same time. A hospital system's risk manager, for example, might track malpractice claim trends, negotiate the terms of a medical professional liability program, and run infection-control audits, all under one job title.
A worked example illustrates the function clearly. A mid-sized manufacturer with a history of forklift accidents hires a risk manager, who reviews three years of workers' compensation loss runs, finds that 40 percent of claims trace back to one warehouse shift, retrains that shift, and negotiates a lower workers' compensation premium with the carrier based on the documented loss control plan. The insurance purchase becomes one tool among several, not the entire strategy.
How Does a Risk Manager Work?
- The exposure audit. The risk manager reviews operations, contracts, property schedules, and historical loss data to catalog where the organization could suffer a financial hit.
- The classification decision. Each identified exposure gets sorted into a strategy: avoid the activity, control the hazard, retain the cost internally, or transfer it through insurance.
- The program design. For exposures slated for transfer, the risk manager works with a broker to structure limits, deductibles, self-insured retentions, and policy forms that match the organization's risk appetite.
- The negotiation and placement. The risk manager and broker approach underwriters, present loss history and risk controls, and negotiate pricing and terms before binding coverage.
- The ongoing monitoring. The risk manager tracks claims, audits vendor certificates of insurance, updates loss control programs, and adjusts the risk financing strategy at each renewal cycle.
Real Claim Examples Involving a Risk Manager
Warehouse fire and underinsured business personal property
A distribution company's risk manager had flagged outdated property valuations during an internal exposure audit two years before a warehouse fire destroyed $4 million in inventory. Because the risk manager had already pushed for an updated appraisal and a blanket limit endorsement, the claim paid close to full value instead of triggering a coinsurance penalty. The carrier's adjuster noted that the company's documentation, maintained by the risk manager's office, shortened the claims investigation significantly.
Subcontractor injury on a general contractor's project
A general contractor's risk manager had required every subcontractor to carry specific additional insured endorsements and submit certificates before mobilizing on site. When a subcontractor's employee was injured and sued the general contractor, the risk manager's certificate tracking system identified the correct subcontractor policy to tender the claim to within a day. The general contractor's own CGL policy was protected from a direct hit because the risk transfer program worked as designed.
Data breach at a healthcare system
A hospital system's risk manager had negotiated a cyber liability policy with a sublimit for regulatory fines a full year before a ransomware attack exposed patient records. The risk manager's pre-incident work, including a breach response plan and a vetted forensic vendor list, meant the claim moved through the carrier's panel counsel immediately. The organization's total out-of-pocket cost stayed within the retention the risk manager had deliberately set based on the company's cash reserves.
Risk Manager vs. Insurance Broker: What Is the Difference?
A risk manager and an insurance broker both work on an organization's risk program, but a risk manager is typically an employee of the insured organization while a broker is an independent agent representing the client to the insurance marketplace. The two roles work together closely, with the risk manager setting strategy and the broker executing placement.
| Comparison area | Risk Manager | Insurance Broker |
|---|---|---|
| Primary use case | Internal exposure identification and risk financing strategy | Market access, policy placement, and carrier negotiation |
| Coverage / concept type | Enterprise-wide risk strategy, not limited to insurance | Insurance procurement and servicing |
| Typical exclusions | Not licensed to sell insurance in most states | Not responsible for internal safety programs or claims reserving decisions |
| Who is most affected by errors | The employer organization, through gaps in coverage or retention mismanagement | The broker's agency, through E&O exposure for placement errors |
| Common mistakes | Over-retaining risk without adequate reserves or reinsurance backing | Treating a risk manager as a standard retail client rather than a sophisticated buyer |
What Are the Most Common Mistakes With Risk Manager Relationships?
- Agencies sometimes pitch risk managers the same way they pitch small business owners, leading with price instead of loss control data and program structure, which signals a lack of sophistication to a technical buyer.
- Producers assume a risk manager wants full insurance transfer, when many risk managers prefer higher retentions or captive arrangements to control long-term cost, creating friction when the agency only proposes guaranteed-cost options.
- Account teams fail to track the certificate of insurance compliance program a risk manager has mandated for vendors and subcontractors, exposing the client to uninsured third-party claims.
- Agencies underestimate the documentation a risk manager expects, including loss run detail, stewardship reports, and claims trend analysis, resulting in lost accounts at renewal.
- Some agencies assume a risk manager has full authority to bind coverage changes without board or finance committee approval, which slows decisions and can cause missed renewal deadlines.
How to Explain Risk Manager to a Client
Explaining Risk Manager to a personal lines client
A risk manager is someone whose job, at a company or organization, is to find ways to prevent accidents and losses before they happen and to decide the smartest way to pay for the ones that still occur. You probably will not need one for your home or auto policy, but think of it like having a dedicated expert whose only job is protecting the organization's bottom line from surprises.
Explaining Risk Manager to a small business owner
A risk manager looks at every part of your operation, from the warehouse floor to your vendor contracts, and figures out where you could lose money unexpectedly. As your business grows, you might not hire a full-time risk manager, but we can fill a lot of that role by reviewing your loss history, tightening your contracts, and making sure your coverage actually matches your real exposures.
Explaining Risk Manager to a CFO or risk manager
Your risk financing strategy should balance retained risk against transferred risk based on your actual loss experience and your balance sheet's capacity to absorb a bad year. We can support that work with benchmarked loss run analysis, contractual risk transfer review, and placement strategies that fit the retention levels you have already set, rather than pushing a one-size-fits-all guaranteed-cost program.
Frequently Asked Questions About Risk Manager
What does a risk manager actually do day to day?
A risk manager spends time reviewing claims data, auditing contracts for indemnification language, inspecting facilities for hazards, and coordinating with brokers on policy renewals. Day-to-day tasks vary by industry, but the common thread is identifying financial exposures before they turn into losses and deciding how the organization should handle each one.
Does a company need a risk manager if it already has an insurance broker?
A broker focuses on placing and servicing insurance policies, while a risk manager looks at the full picture of organizational risk, including exposures that insurance cannot cover, such as reputational damage or supply chain disruption. Many mid-sized and large organizations use both roles together, with the risk manager setting strategy and the broker executing the insurance placement.
Is a risk manager the same as a safety manager?
A safety manager typically focuses narrowly on workplace safety compliance and accident prevention, while a risk manager has a broader mandate that includes insurance program design, contract risk transfer, and claims oversight. Some smaller organizations combine both functions into one role, but larger companies usually separate them.
What licenses or credentials does a risk manager need?
A risk manager does not need an insurance producer license to do the job, since the role does not involve selling insurance, but many risk managers earn designations such as the Associate in Risk Management (ARM) or Chartered Property Casualty Underwriter (CPCU) to build technical credibility. Credentials vary widely by industry and organization size.
Why does a risk manager sometimes refuse insurance a broker recommends?
A risk manager may reject a proposed policy because the organization has already decided to retain that exposure internally through a higher deductible, a captive insurance arrangement, or a dedicated reserve fund. This is a deliberate risk financing decision, not a misunderstanding of the coverage, and agencies who push back without understanding the retention strategy often damage the relationship.
Can an independent agency serve a client that has its own risk manager?
An independent agency can absolutely serve a client with an internal risk manager, and many of the most valuable agency relationships work exactly this way. The agency's role shifts from being the primary risk decision-maker to being a specialized resource that executes placement, provides market intelligence, and supports the risk manager's strategy with data and carrier access.
Related Insurance Terms
- Risk Management: the overall discipline of identifying, assessing, and controlling loss exposures, of which the risk manager is the person responsible for execution.
- Self-Insured Retention: a dollar amount a company agrees to pay out of pocket before insurance responds, a tool a risk manager frequently uses instead of full insurance transfer.
- Loss Control: proactive measures taken to reduce the frequency or severity of losses, a core function a risk manager oversees alongside insurance placement.
- Certificate of Insurance: a document proving a party carries specific insurance coverage, which a risk manager typically requires from vendors and subcontractors as part of a contractual risk transfer program.
- Third-Party Administrator: an outside company that handles claims processing for a self-insured program, often engaged directly by a risk manager to manage workers' compensation or liability claims.
- Captive Insurance Company: an insurer owned by the organization it insures, a structure a risk manager may create to retain risk more efficiently than traditional insurance allows.
- Enterprise Risk Management: a broader organizational framework for managing all categories of risk, including financial and strategic risk, that a risk manager increasingly operates within rather than focusing on insurable risk alone.
Sources and References
About the Author
Justin Goodman, CIC, CCIP, CISC, CLCS, CRIS, PCIA, QCLS, MFHR CEO and Co-Founder, Total CSR, Inc.
Justin Goodman is a third-generation insurance broker with over two decades in agency operations. He has trained more than 100,000 CSRs, account managers, and producers in commercial and personal lines coverage, from workers' compensation to construction risk. He was named 2024 Insurance Journal Agent of the Year and one of the nation's top five construction insurance experts by Risk & Insurance. He is the author of Retain, which applies cognitive science research on memory and knowledge transfer to insurance training, and speaks nationally on how agencies build durable technical expertise in their teams.