What it means
Every business takes risk, but a professional risk manager makes it visible and puts a number on it. They look at the chance of losing money from price swings, customers failing to pay, broken internal processes, cash running short and a long list of other causes.
The aim is not to remove risk, which would also remove profit, but to make sure the business takes the right amount of it on purpose. In banks, insurers and investment firms the role is often a formal function that sits apart from the people earning the revenue.
That separation matters because a trader or salesperson paid on results has a natural pull towards bigger bets, so someone independent needs the authority to set limits and say no. In ordinary companies the title is less common, but the work still exists under names such as treasury, credit control or enterprise risk.
A risk manager there might set a maximum amount of credit to extend to any single customer, decide how much foreign currency exposure to hedge, or build the scenario that shows the board what a bad year would look like. The PRM designation is one route into the profession and is earned by passing exams covering finance theory, risk measurement, regulation and professional ethics.
Other well-known credentials exist as well, so a job advert asking for "a recognised risk qualification" may accept several different ones. The tools of the trade include limits, stress tests and statistical measures such as value at risk (the loss that should not be exceeded on a normal day with a stated level of confidence).
Good risk managers also learn to explain these numbers in plain language, because a measure that executives cannot understand will not change any decisions.
In practice
Real-world examples.
Example
A regional bank employs a risk manager who sets a limit of $5,000,000 on lending to any single property developer. When a developer asks for $7,500,000, the loan officer must either syndicate part of it to another lender or decline the excess.
Example
A food importer buys ingredients in euros but sells in dollars. Its risk manager recommends using forward contracts to lock in the exchange rate on 70% of expected purchases for the next six months, so a sudden currency move cannot wipe out the margin on a $12,000,000 order book.
Example
A software company's finance team appoints a risk manager after one customer accounts for 40% of revenue. She builds a simple scenario showing that losing that customer would cut annual operating profit from $3,000,000 to a loss of $1,000,000, and the board approves a plan to widen the customer base.
Formula
Calculation
One of the most common measures a professional risk manager reports is parametric value at risk, which estimates the likely maximum one-day loss at a chosen confidence level:
Value at risk = Portfolio value x Z-score x Daily volatility
At 95% confidence the Z-score (the number of standard deviations that marks the cut-off) is about 1.65. Suppose a treasury portfolio is worth $10,000,000 and its daily volatility (how much its value typically moves in a day) is 1%.
Value at risk = $10,000,000 x 1.65 x 0.01 = $165,000.
The risk manager would report that on 95% of days the portfolio should lose no more than $165,000, and that on the remaining 5% of days the loss could be larger. At 99% confidence the Z-score rises to about 2.33, so the same portfolio would show $10,000,000 x 2.33 x 0.01 = $233,000.Case study
Seen in the real world.
Harbour Ridge Capital is an illustrative, fictional asset manager that grew quickly by letting each portfolio manager choose their own position sizes. The founders liked the freedom but had no single view of how much money the firm could lose if several managers made the same bet at the same time.
They hired a professional risk manager who began by listing every position and grouping them by theme. She found that six of the eight managers had large holdings in the same industry, so what looked like eight separate portfolios was really one big concentrated bet.
She introduced a firm-wide limit on any single industry and a monthly stress test, and the managers grumbled at first. When that industry fell sharply the following year, losses were noticeably smaller than they would have been, and the freedom debate ended quietly. The lesson in this illustrative story is that risk looks very different when someone adds it all up.
Watch out
Common mistakes.
- Thinking a risk manager's job is to stop the business taking risks, rather than to make sure the risks taken are understood, priced and within limits.
- Treating a single statistic such as value at risk as a guarantee, when it says nothing about how bad the loss could be on the unlucky days beyond the cut-off.
- Placing the risk manager under the same person who earns bonuses from risk-taking, which weakens their independence and their willingness to challenge.
Questions
People also ask.
Do you need the PRM designation to work in risk management?
No, it is one respected credential among several, and many risk professionals are qualified through other routes or through experience.
What is the difference between a risk manager and an auditor?
A risk manager looks forward and helps control risks as they are being taken, while an auditor looks back to test whether controls and records were reliable.
Which risks does a risk manager usually cover?
The main groups are market risk, credit risk, liquidity risk and operational risk, and many firms add strategic and compliance risk as well.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%