r/riskmanager

I have a background working with the NFIP and currently work in insurance claims. I’m interested in eventually moving into risk management and would appreciate some advice from people already working in the field.

I’m currently working toward my AINS designation and am considering getting my P&C license next. After that, I’ve been looking at the ARM designation, but I’m open to other suggestions.

For someone with my background, what would you prioritize over the next year or two to make the transition into risk management? Are there particular designations, skills, or types of roles I should be targeting to help bridge the gap from claims into risk?

If you are interested in this position in Suffolk, VA. DM me

https://bah.wd1.myworkdayjobs.com/en-US/BAH\_Jobs/job/Risk-Management-Framework-Analyst\_R0246612-1

We have a methodology for information security risk management but none for operational risks management. I have less than a month to adapt our current methodology to also include operational risks. Is that feasible?

I have no idea how to start with operational risks management. I know that it should be done for processes and services but I have very limited knowledge of the company's processes and services. Information security has been a little easier bc we can use catalogues of threats and vulnerabilities from iso 27000 that we apply to assets. But I can't find anything similar for operational risks and I don't know what to do. Is it supposed to be scenario based analysis rather than asset based analyis, as it is done for information security risks?

Also I know the general steps of risk identification, analysis (impact probability and evaluation), treatment (transfer, reeducation, avoidance, acceptance) and monitoring. For me the biggest challenge is identification I suppose - actually coming up with the risks for the processes. Are there any resources that can help to formulate scenarios or something like that?

If anyone can give me some guidance, any help would be hugely appreciated. I am extremely stressed and struggling a lot.

Edit: thanks a lot for the suggestions. I will use them as much as I can. I have one more week to write the methodology. It seems management either wants trash or has no idea what's going on. I don't have a lot of experience but this sounds unreasonable to me.

I love risk mgmt BUT how much value really brings? I worked for highly regulated and tech, for reference, and I feel risk mgmt is the mean to nothing. Trapped between the low hanging fruit of isolated and atomic issues, in general, with low impact vs glorified macro risk categories that are reading tea leaves. Is anybody proud pf any risk they managed or fully remediated (aka reduced) that you feel proud about?

Currently I work as an EHS Manager for a manufacturing company. Have been in a manger role the last 3 years and have been in EHS for 8 years. I like EHS because I like the mitigation/control side but lately I have been contemplating if it’s what I want to do for the rest of my career (30 years old). I have a Masters in Safety/Security/and Emergency Management and am currently studying for my CSP. But I’ve been reading up on ERM lately and have been wondering if it is a logical switch and how might I go about it? I’ve even been looking into some graduate programs but kind of iffy on that. Any thoughts/advice is greatly appreciated.

Also - currently making 135k a year with a 10% bonus… if I were to make a switch, what might that look like initially from a compensation perspective.