You’re starting a new job in Risk Management. How can you make the most of your first month?

Some of the best risk leaders I have seen made it a priority to get to know the business first. There will always be a need to manage triage activities alongside strategy development at the beginning. But investing in understanding end-to-end operations, historic, current, and future strategic objectives and key results is the most critical foundation for leading risk.

Listen. For the first 30 days try to resist telling people how they should change what they do to make it more like whatever you have most recently done and just listen…….

Here are a few steps to help you get started: 1) Obtain a clear understanding of the organisation’s Risk Culture - Observe conversations, attitude and behaviour towards managing risk. 2) Review the existing risk framework, risk process, risk identification techniques, risk assessment and risk register - Gain clarity on the existing risks of the organisation and obtain a clear understanding on the nature of business and industry of the organisation. 3) Engage with key stakeholders - Build relationships with key stakeholders by understanding their individual roles, concerns and limitations in managing risk.

Try not to put a lot of pressure on yourself. Take time to go through the onboarding process and learn the inner workings of the organization. Take advantage of the learning platforms (including LinkedIn learning) to gain more skill on the desk. Also, do not be afraid to ask questions.

1. Be patient and learn the business 2. Observe, absorb, and listen 3. Understand what motivates the leaders 4. Get familiarized with the risk culture It’s not about what you think should be done, it’s about what the business needs to manage risk effectively.

In any new job as a people leader, especially in a technical area, it is about building the relationships. Learning the process is important, but listen to your peers and key stakeholders.

Listening. Listen to the good. To the bad. What people wish could be done differently. When I start a new role in risk management, I never go in thinking I’m going to change everything. Sure, I have a vision, but I’m also aware that some things are already being done extremely well. The team you come in to lead will tell you all you need to know if you open the floor and sincerely listen to what they have to say.

Suggest this is #1. Establishing trust is the principal foundation to collaboration. When the business knows that you are there to understand, and enable the business to grow in a safe framework, practicalities of risk management are far more efficient and effective in a proactive way - always far better than reactive scrambles. Note: separation of duties and responsibilities should not be impacted by these relationships.

Regardless of how much you know about risk management, take time to know the company and its people as much as you can before taking action. So much about real world risk strategy hinges on the culture of the company and the way units interact with each other, the inner workings of corporate governance, etc. Knowing when to do something or who can help you achieve it comes before the thing itself in most cases.

This point cannot be stressed enough. Relationships are key to building trust and rapport. Without those, you will never cultivate an ideal working environment. First, you need to listen and learn. Put in the effort to talk with people where they are comfortable (whether that is via email, Teams, Zoom, phone, lunch, etc.). Risk management requires partnership, to earn that you will need to demonstrate that you bring value. Once a relationship is established, I operate on the karma system. I will do whatever is in my power to help a colleague. On the flip side, I will not hesitate to call on others for guidance or collaboration. This has been a simple yet effective practice that has helped me build and strengthen relationships.

In your first month, its two things that are super important, the first is working out which of the risks are the important risks (I know this has been mentioned a lot already) and the second is to get known quickly i.e. build your network with those that make the decisions. Knowing the risks is one thing but not being able to influence the outcome means you're not really risk managing.

Established clear and smart kpis Is a key success to ensure all target are secured and smart enough to be achieved Define clear kpi s hepls to succed

Starting a career in risk management requires understanding of various key aspects. Firstly it’s essential to familiarize yourself with different types of risks such as credit, market, operational, and liquidity risks, and understand how each type impacts organisations. Additionally, gaining knowledge of industry-specific regulatory frameworks, like Basel III for banking or Solvency II for insurance, is crucial. developing strong data analysis skills and proficiency in tools like Excel, SQL, and risk management software will enable you to interpret and manage risk-related data effectively.

Addressing the bleeding issues within the organization should be a top priority. Identifying these critical problems is essential for proactive and solution-oriented risk management. An experienced risk manager should be adept at accurately prioritizing these issues based on the initial information available.

1. Understand your executive teams strategic and tactical priorities. 2. Realize you are part of a team - collaboration is key. 3. Ask questions to learn where there are blind spots or bias.

Saying what has already been said but try and work out which risks matter the most. Then try and drive the conversations with senior stakeholders and deliver solutions to resolve the things that really matter. And by default (and to quote the title of a good book) don’t sweat the small stuff.

The key to analyzing organizational risk depends on your understanding of the risk appetite of the company and the context it operates in. In my experience as a geopolitical and security intelligence analyst, understanding that organizational risks looks different to different sectors and groups is key in risk analysis. This understanding informs how you should analyze the risks and make sense of the results- eg the indicators to consider when performing a risk analysis for a supply chain business is different from the one you do for a pharmaceutical company in a specific location. This will help narrow the modes of assessment to be used, and the presentation of results and recommendations.

First, identify the risks that could impact your organization, understand threats and vulnerabilities. Once you have a list of risks, assess their impact and likelihood and understand how they might affect your business in order to prioritize risks and allocate resources effectively.

It might have been already covered. But prioritising the risk and its consequences should be the focus here. And there should be a plan beforehand to overcome the consequences. Lessons learned by own experiences or through subordinates helps in assessing risks.

Very important to analyze each major inherent risk, what mitigations exist, and the final residual risk. Unfortunately, people stop there. It's essential to build a correlation matrix to understand how each risk relates to other risks the organization faces. Also, what are the historical risk losses over time. Do you know the mean and standard deviation? Without these measure and the correlation matrix, you have no idea how effective your mitigation efforts are to the overall enterprise. You may find multiple risks with negative correlations that may not even need mitigations, for instance. Few organization, unfortunately, think this deeply about it...

Risk forecasting = embracing uncertainty None always gets risk forecasting exactly right but by focusing and embracing it, trends and triggers can be identified to make it more certain.

Risk management requires a degree of flexibility. Not necessarily in the process itself, but being aware that things change and your approach must change with it (explains why we have multiple Basel norms). At an organisational level, you'll want to keep things moving and flexibility and adaptability are the skills that will help you get there.

Be CHANGE READY. This is crucial in the sailing through the evolution of risk across different fields. The risk appetite changes based on acceptance or otherwise of certain risks which is influenced by several parameters. Technology will advance on the management of risks, identification and control, teams must be ready to twerk risk management operations to align with emerging risks… and the tackling of same has not and will not be business as usual. Consistently upskilling, keeping abreast of risk trends, adaptability to risk management technique changes among other will definitely guide a manager in effective delivery on the role.

A gestão de riscos é uma disciplina que não se fundamenta em ciência exata, como evidenciado pelo contexto global atual com desafios econômicos, conflitos armados e consequências pós pandemia. Para mitigar esses desafios, devemos permanecer atualizados e estar sempre abertos a novas abordagens na gestão de riscos.

We cannot have fun in risk assessment and analysis otherwise we will be topic of “FUN” in the organisation. No solution is perfect as uncertainty is always is inbuilt in the solution or system. Our aim to minimise the uncertainty.

Always have a bit of fun and add joy to work. Risk is often viewed as a negative by Line 1 as a blocker. Try to make your interactions about achieving their objectives not just risk objectives. When explaining risk use funny, interesting and personable examples.

Aproveitar ao máximo seu primeiro mês em gestão de riscos envolverá um equilíbrio entre aquisição de conhecimento, estabelecimento de relacionamentos e definição de metas claras. Essas etapas iniciais são fundamentais para estabelecer uma base sólida e estar bem preparado para as atividades de gerenciamento de risco no futuro.

I'm not certain "fun" is the correct word. I think it is vastly more important to be passionate about risk management. When I was an insurance broker, I took a lot of pride that, when the worst moments hit, the first call is emergency services, and the second call was to us. It can absolutely be exhilarating to solve complex risk problems, but more than fun, it is about dedication to navigating a crisis situation to be of service to either a person or an organization. Another aspect of "fun" in risk management is the strategic alignment of how to treat risk? Is this best handled by insurance, or would internal controls be superior. It brings the same joy as a competitive game of chess, except we get to do good work in the process.

In my experience you can have fun while working, however you must take what you do extremely seriously. And learn that there is time for everything.

Learn the business and the inherent risk associated with the business/industry. From there you can assess risk from that baseline and find sr management’s “risk tolerance” and just build a bridge using a Safety Management System (SMS) to close the gap.

When you start afresh in any role you should have 30-60-90 day plan and below are few important things you want accomplish in first 30 day 1) Spend time to understand how the organization is structured and how the firm makes money 2) Spend time knowing your team 3) Go and meet your stakeholders, put a face to the name 4) understand who your peers are and how the work is connected, you don't introduce yourself to your neighbors when their is fire in the house. 5) Sit down with your boss and understand his priorities and make sure you have a common definition of success

Get Comfortable with being disliked. It's not said all the time, but most times your role requires firmness too, and not many people like that. So, build necessary relationships, but don't let those impact on your ability to get the work done, or insist on the right way for things to get done.

The first month as a CRO is crucial. Focus on building relationships. Meet key leaders across departments, understand their risk concerns, and actively listen. Immerse yourself in the existing risk framework – policies, tools, data. Identify knowledge gaps and potential areas of improvement. Finally, champion a culture of risk awareness – get everyone talking risk, not fearing it. Foster a "risk aware" culture – it's everyone's game. This sets the stage for proactive risk management that protects the company's future. 👉 Remember, it's the first 30 days of a long journey. Your strength begins with deep understanding, establishing a varied team, and then starting based on your expertise and skills.