Risk Management - Competency
Definition: Managing Risk is the disciplined ability to evaluate risk information, analyze operational and strategic exposures, remain aware of emerging threats, and accurately determine potential consequences to guide appropriate levels of acceptable risk. It involves designing and integrating risk initiatives into existing processes, making informed decisions in fluid conditions, and applying mitigation, control, and response strategies that balance safety, productivity, and organizational resilience. Effective Managing Risk also requires monitoring trends, adapting to changing conditions, fulfilling accountability for risk systems and data, and supporting consistent process execution across teams. It is strengthened through clear communication, ongoing training, and a culture that both respects controls and embraces calculated risks that create value.
360-Feedback Assessments Measuring Risk Management:
Survey 1 (4-point scale; Competency Comments)
Survey 2 (4-point scale; Competency Comments)
Survey 3 (5-point scale; Competency Comments)
Survey 4 (5-point scale; radio buttons)
Survey 5 (4-point scale; words)
Survey 6 (4-point scale; words)
Survey 7 (5-point scale; competency comments; N/A)
Survey 8 (3-point scale; Agree/Disagree words; N/A)
Survey 9 (3-point scale; Strength/Development; N/A)
Survey 10 (Comment boxes only)
Survey 11 (Single rating per competency)
Survey 12 (Slide-bar scale)
Survey 13 (4-point scale; numbers; floating anchors)
Survey 14 (4-point scale; N/A)
Self-Comments: Do you have to complete a self-assessment or performance appraisal? If so, the
self-comments here may help.
What are Risk Management Skills?
Managing Risk is the comprehensive capability to evaluate potential threats by determining how risk information should be used, assessing the organization's tolerance for uncertainty, and weighing the likelihood and consequences of different events. It requires strong analytical judgment to balance operational needs with safety requirements, identify serious threats, and conduct audits that reveal vulnerabilities. This foundation is strengthened by acute risk awareness--the ability to accurately perceive emerging risks, initiate preventative measures, and determine whether the level of exposure is acceptable based on anticipated outcomes.
Managing Risk also involves designing and integrating initiatives that embed risk thinking into organizational processes and strategies. Leaders must make informed decisions in fluid conditions, accepting or avoiding risk as appropriate while implementing mitigation strategies, establishing internal controls, and ensuring that risk management components function effectively. At the same time, they recognize that some risks create opportunities, using strategic insight to embrace calculated risks that add value and advance organizational goals.
Finally, Managing Risk requires ongoing monitoring, responsive action, and organizational stewardship. This includes analyzing trends, adjusting monitoring processes, and ensuring mitigation measures are consistently applied, as well as developing contingency and continuity plans that enable rapid adaptation when conditions change. Effective practitioners integrate data and processes across the company, support teams in applying risk procedures, communicate expectations clearly, and build capability through training and coaching. Through this combination of vigilance, action, communication, and development, Managing Risk becomes a shared, strategic discipline that strengthens resilience and performance across the organization. Core Components of Risk Management
- Evaluates Risk: the strategic application and integration of risk management. It emphasizes determining how risk information is used, assessing risk tolerance levels, and evaluating the likelihood and impact of risks to inform decisions.
- Risk Analysis: the systematic process of identifying, assessing, and prioritizing risks. It involves gathering data on potential risks, conducting audits, and using tools like Monte Carlo simulations to quantify risks and their impacts.
- Risk Awareness: the identification and understanding of risks. It involves accurately perceiving potential risks in various aspects of operations, being mindful of regulatory compliance, and assessing the financial implications of those risks.
- Determines the Consequences: evaluating the specific impacts and outcomes of risks. It involves assessing whether risks are tolerable, analyzing their effects on finances, reputation, or infrastructure, and prioritizing actions based on their potential consequences.
- Design Initiatives: proactive planning and strategic preparation for risk management. This dimension emphasizes creating comprehensive risk management strategies, policies, and frameworks that align with organizational processes and objectives.
- Manages Risk: the strategic and structured risk management focusing on how a manager anticipates, interprets, and positions the organization in relation to uncertainty over the long term. This includes scanning for patterns in changing information, weighing acceptable levels of risk, and making decisions that balance opportunity and protection.
- Mitigates Risk: the concrete actions a manager takes to reduce the likelihood, severity, cost, or operational impact of risk events. This includes implementing mitigation strategies, reinforcing procedures, communicating changes, and using data to prevent or minimize disruptions.
- Controls Risk: the protective, preventive, and stabilizing side of Managing Risk by reducing uncertainty, tightening processes, and ensuring that operations stay within safe, predictable boundaries. They build and maintain internal controls, set tolerances for deviation, and intervene early when small issues could snowball into larger failures.
- Embraces Risk: the opportunistic, growth-oriented, and value-creating side of Managing Risk as a potential catalyst for innovation, competitive advantage, or strategic gain. They intentionally pursue calculated risks that could advance the organization, reward bold thinking, and convert uncertainty into opportunity.
- Monitors Risk: situational awareness, surveillance, and interpretation by continuously scanning for signals (data trends, incidents, control performance, external shifts, and operational changes) that may alter the organization's risk profile. Their focus is on detecting patterns, identifying vulnerabilities, assessing whether mitigation efforts are working, and ensuring that monitoring processes remain current and effective.
- Risk Response: action, adaptation, and intervention by deciding what to do once a risk is detected or when conditions change unexpectedly. They create contingency and continuity plans, adjust thresholds, implement controls, and take steps to reduce losses, minimize impact, and restore stability.
- Responsibilities: the ownership, accountability, and stewardship side of Managing Risk through the formal duty to oversee regulatory, strategic, operational, and project-level risks. Managers with these responsibilities maintain records, prepare reports, track compliance, and ensure the organization has accurate, timely information about its risk posture.
Why are Risk Management skills important?
Risk Management helps identify, assess, and mitigate potential threats that could derail organizational goals. Risk management also helps identify potential opportunities and advantages that may be created in the process. By proactively managing risks, businesses can avoid costly disruptions, protect their assets, and ensure regulatory compliance. It also enhances decision-making by providing valuable insights into potential opportunities and challenges, ultimately leading to improved resilience and a competitive edge. In essence, effective risk management fosters stability and growth. What are key aspects of Risk Management?
Key aspects of risk management include:- Evaluating and Assessing Risk
- Being aware of risk and its consequences
- Managing, Mitigating, and Controlling Risk
- Monitoring and Embracing Risk
How can I improve my Risk Management skills?
- Evaluating Risk: Focus on developing a structured framework for assessing and prioritizing risks. Collaborate across departments to ensure comprehensive risk assessments. Engage in informed decision-making and continuous learning by staying updated with industry best practices and regulatory requirements.
- Risk Analysis: establish a systematic approach for gathering and evaluating risk data. Engage in ongoing training and development to stay updated with the latest risk assessment tools and techniques, such as Monte Carlo simulations and decision analytics. Prioritize actions based on the most critical threats and opportunities.
- Design Initiatives: Focus on continuously updating your knowledge of risk management best practices and frameworks, ensuring alignment with evolving industry standards and regulations. Engage in cross-functional collaboration to gather diverse perspectives and utilize advanced analytical tools for a more comprehensive and dynamic approach to risk management.
- Mitigation: Continuously update your knowledge of global events, supply chain dynamics, and financial trends. Leverage advanced data analytics to anticipate and plan for potential risks, ensuring you have robust contingency strategies. Foster a culture of proactive risk management within your organization, ensuring all departments are aligned and prepared to respond swiftly to adverse events.
What questions could be included on a 360-degree survey that measure Risk Management?
The questionnaire items below will measure Risk Management. These questions are grouped into different facets of Risk Management. When creating a 360-degree or other performance assessment, try to select one or two items from each group. Questions to include on your survey.
Evaluates RiskEvaluates Risk focuses on the strategic application and integration of risk management. It emphasizes determining how risk information is used, assessing risk tolerance levels, and evaluating the likelihood and impact of risks to inform decisions. This dimension is action-oriented and centers on aligning risk management practices with corporate objectives, ensuring smooth operations, and remaining compliant with regulations. It is broader in scope, considering the role of risk management in enhancing strategic decision-making and project implementation.
- Uses risk management to be more effective in identifying and implementing projects.
- Identifies emerging risks by reviewing operational data, environmental changes, and early warning indicators.
- Uses risk management to ensure smooth operations.
- Evaluates the probability of a risk event occurrence.
- Identifies what actions the organization is willing to take.
- Evaluates risks in terms of their consequences and likelihood of occurrence.
- Evaluates the impact of certain events on the attainment of corporate objectives.
- Determines the risk tolerance of the company.
- Uses risk management to remain in compliance with regulations.
- Determines how the risk management information is to be used.
- Uses risk management to make better strategic decisions.
Risk AnalysisRisk Analysis highlights the systematic process of identifying, assessing, and prioritizing risks. It involves gathering data on potential risks, conducting audits, and using tools like Monte Carlo simulations to quantify risks and their impacts. This dimension is more focused on the analytical and technical aspects of risk assessment, providing detailed evaluations to determine critical threats and prioritize action based on probability and impact.
- Gathers information regarding potential risks.
- Evaluates risks against acceptable risk levels.
- Performs regular risk analyses to minimize adverse outcomes.
- Performs a risk analysis as needed.
- Conducts internal audit of risk assessments.
- Quantifies current business practices to make better informed decisions.
- Determines which are the serious threats.
- Reviews historical risk events to anticipate future patterns.
- Balances operational needs with risk requirements to maintain both safety and productivity.
- Evaluates risk metrics over time to determine whether exposure is increasing, decreasing, or stabilizing.
- Prioritizes risks based on probability of occurrence and possible impact to the company.
- Uses Monte Carlo Risk Simulations and decision analytics to create the best possible strategic decisions.
- Prioritizes risks to act on critical issues first.
- Prioritizes the risks to determine the most pressing needs.
Risk AwarenessRisk Awareness emphasizes the identification and understanding of risks. It involves accurately perceiving potential risks in various aspects of operations, being mindful of regulatory compliance, and assessing the financial implications of those risks. This dimension is centered on the proactive recognition and acknowledgment of risks as potential threats or opportunities, enabling preventative measures and informed decision-making.
- Perceives the risks of different work tasks and activities.
- Accurately perceives potential risks in the workplace and initiates preventative measures.
- Is aware of the financial implications of certain risks.
- Is aware of process safety management.
- Has the knowledge and skills to accurately identify risks in the workplace.
- Accurately perceives potential risks in the workplace.
- Understands that risk may represent a threat or an opportunity.
- Understands how to meet regulatory compliance.
- Informs leadership promptly of any significant changes in risk levels.
- Understands the possible financial risks of different events.
- Identifies the most significant risks from business operations.
Determines the ConsequencesDetermines the Consequences focuses on evaluating the specific impacts and outcomes of risks. It involves assessing whether risks are tolerable, analyzing their effects on finances, reputation, or infrastructure, and prioritizing actions based on their potential consequences. This dimension emphasizes turning risk insights into actionable strategies, including identifying opportunities that risks may present for growth or advantage.
- Accurately determines appropriate risk levels (i.e., levels of acceptable risk).
- Determines the impact of specific risks on reputation.
- Determines the potential financial impact of specific risks.
- Looks for opportunities to turn a risk event into an advantage for the company.
- Determines the impact of specific risks on infrastructure.
- Determines the impact of specific risks on marketplace.
- Recognizes the potential impact of systemic risks.
- Anticipates the consequences of different potential risk events.
- Recognizes the potential financial impact of specific risks.
- Determines if the level of risk is tolerable.
- Determines the potential outcome of adverse risk events.
- Seeks to capitalize on risks.
- Determines the impact of specific risks on finances.
Design InitiativesDesign Initiatives centers on proactive planning and strategic preparation for risk management. This dimension emphasizes creating comprehensive risk management strategies, policies, and frameworks that align with organizational processes and objectives. It involves systematically establishing the context for risk activities, designing proportionate responses, and determining tools and frameworks to efficiently manage risks before they occur. "Design Initiatives" is about laying the groundwork for effective risk management through thoughtful preparation and structure.
- Creates a risk profile for projects and teams.
- Creates a risk management strategy for the organization.
- Creates a risk management strategy for the department.
- Develops policies for risk management.
- Develops policies to address risk situations in the workplace.
- Determines a proportional response in relation to the level of risk.
- Establishes the context for risk management activities.
- Creates dynamic and responsive enterprise risk management processes.
- Aligns risk management activities with existing processes.
- Designs risk management activities that support the success of the company.
- Determines the proper tools to efficiently manage the risk.
- Designs risk response activities that are proportionate to the level of risk.
- Outlines the risk management framework including responsibilities, description of the process, and guidance on evaluating risk criteria and appropriate risk responses.
Manages RiskManages Risk reflects the strategic and structured risk management focusing on how a manager anticipates, interprets, and positions the organization in relation to uncertainty over the long term. This includes scanning for patterns in changing information, weighing acceptable levels of risk, and making decisions that balance opportunity and protection. Someone strong in this area treats risk as a strategic variable--something to avoid, transfer, accept, or even leverage for advantage. They think in terms of departmental viability, organizational sustainability, and the broader ecosystem in which risks evolve. Manages Risk is about governance, strategy, and decision-making under uncertainty.
- Seeks to maintain the long-term viability of the Company through effective risk management.
- Effectively manages risk for the department.
- Bases decisions on patterns found in fluid/changing information.
- Works effectively to avoid risk.
- Accepts risk as needed.
- Works effectively to mitigate risks.
- Views risks as potential opportunities for profit.
- Works effectively to transfers risk.
- Implements strategic risk management in an objective and tactical way.
Mitigates RiskMitigates Risk focuses on the concrete actions a manager takes to reduce the likelihood, severity, cost, or operational impact of risk events. This includes implementing mitigation strategies, reinforcing procedures, communicating changes, and using data to prevent or minimize disruptions. Someone strong in this area works to reduce losses, delays, and damage; strengthen resilience; and ensure that mitigation components are functioning as intended. They translate strategy into action by putting controls in place, monitoring their effectiveness, and adjusting responses to contain costs and consequences. Mitigates Risk is about execution, prevention, and minimizing harm once risks materialize.
- Uses financial data to mitigate financial risks.
- Takes steps to reduce the occurrence of the risk events.
- Increases business resilience.
- Takes steps to contain the costs of responding to such events.
- Explains the purpose and value of risk mitigation procedures to increase buy-in and compliance.
- Uses data from the purchasing department to anticipate possible supply chain risks.
- Implement strategies to mitigate risks.
- Minimizes operational setbacks and delays.
- Communicates changes in risk mitigation processes promptly and clearly.
- Minimizes the increase in costs due to global events or supply chain issues.
- Takes steps to minimize the impact/damage of the risk events.
- Ensures all components of risk management are in place.
- Knows how to obtain desired results with minimal losses.
Controls RiskControls Risk reflects the protective, preventive, and stabilizing side of Managing Risk by reducing uncertainty, tightening processes, and ensuring that operations stay within safe, predictable boundaries. They build and maintain internal controls, set tolerances for deviation, and intervene early when small issues could snowball into larger failures. Their mindset is oriented toward minimizing exposure: reducing the likelihood of incidents, strengthening safeguards, and ensuring that decisions--especially risky ones--are grounded in solid information. In essence, Controls Risk is about containment, discipline, and maintaining reliability through structured oversight.
- Develops appropriate strategies to minimize risks.
- Aware of appropriate actions to minimize risks.
- Implements changes to reduce the chances of critical incidents in the future.
- Recognizes that small changes may snowball into major events.
- Manages risk control systems to ensure they are functioning as intended.
- Determines the amount of deviation from the plan that will be tolerated.
- Adopts a risk-based approach to establishing systems of internal controls.
- Ensures that any risky decisions taken are based on informed decision making.
- Establishes good controls over the process to better manage risks.
- Seeks to reduce uncertainty (risks) in the supply chain.
Embraces RiskEmbraces Risk reflects the opportunistic, growth-oriented, and value-creating side of Managing Risk as a potential catalyst for innovation, competitive advantage, or strategic gain. They intentionally pursue calculated risks that could advance the organization, reward bold thinking, and convert uncertainty into opportunity. While they still recognize and mitigate risks, their emphasis is on leveraging them--identifying where risk-taking can unlock new value, accelerate progress, or differentiate the business. In essence, Embraces Risk is about strategic boldness, opportunity seeking, and turning uncertainty into advantage.
- Rewards risky ideas that may yield significant benefits.
- Turns risks into opportunities for advancement.
- Identifies and mitigates risks while making informed, strategic decisions.
- Turns risks into opportunities.
- Identifies opportunities that may be created by taking specific risks.
- Seeks specific risks that will create opportunities to advance the department/company.
- Adds value to the organization through acceptance of certain risk.
- Takes calculated risks by effectively recognizing and managing them.
- Seeks to add value to the company by embracing risk.
Monitors RiskMonitors Risk is fundamentally about situational awareness, surveillance, and interpretation by continuously scanning for signals (data trends, incidents, control performance, external shifts, and operational changes) that may alter the organization's risk profile. Their focus is on detecting patterns, identifying vulnerabilities, assessing whether mitigation efforts are working, and ensuring that monitoring processes remain current and effective. This behavior is proactive but observational: it emphasizes watching, analyzing, auditing, and communicating what the risk landscape looks like so the organization stays informed and prepared.
- Tracks and monitors incidents that may increase the risk of adverse consequences.
- Tracks risks in a project.
- Adjusts monitoring processes based on lessons learned, new data, or changes in organizational priorities.
- Keeps watch on external factors (regulatory, market, environmental) that may alter the organization's risk profile.
- Coordinates with cross-functional teams to ensure risk monitoring is embedded in daily workflows.
- Evaluates whether current monitoring tools and methods remain adequate and recommends improvements.
- Uses actionable data and analytics to improve risk tolerance.
- Performs monthly risk management assessments.
- Monitors risk events and notifies appropriate stakeholders.
- Monitors enterprise risk management activities for their impact and effectiveness on mitigating risks.
- Monitors leading and lagging indicators to detect shifts in risk exposure before issues escalate.
- Monitors the effectiveness of risk management strategies.
- Assesses whether risk mitigation measures are being consistently applied across teams or departments.
- Monitors how operational changes (new processes, staffing shifts, technology updates) affect risk exposure.
- Conducts regular audit of the risk management framework.
- Analyzes trends in incident data to identify recurring vulnerabilities or systemic weaknesses.
Risk ResponseRisk Response is about action, adaptation, and intervention by deciding what to do once a risk is detected or when conditions change unexpectedly. They create contingency and continuity plans, adjust thresholds, implement controls, and take steps to reduce losses, minimize impact, and restore stability. Their focus is on responding to events (anticipated or unanticipated) with agility and judgment. While Monitors Risk tells you what is happening, Risk Response determines what happens next.
- Effectively responds to critical situations to reduce potential for losses.
- Responds appropriately to unexplained or unanticipated events.
- Able to adapt quickly to changing situations.
- Avoids maintaining the status quo (or standard operating procedures) when addressing new and influential situations.
- Verifies that corrective actions from previous assessments remain effective over time.
- Revises risk thresholds and triggers as conditions evolve.
- Identifies the controls needed.
- Decides what actions will be taken.
- Reduces risk to a manageable level.
- Create contingency plans.
- Creates a level of resilience in the organization.
- Create continuity plans.
ResponsibilitiesResponsibilities reflects the ownership, accountability, and stewardship side of Managing Risk through the formal duty to oversee regulatory, strategic, operational, and project-level risks. Managers with these responsibilities maintain records, prepare reports, track compliance, and ensure the organization has accurate, timely information about its risk posture. Their work is often analytical and governance-focused: integrating data across the company, generating insights, and informing strategic decisions. In essence, Responsibilities is about being the accountable owner of the risk management function--ensuring the systems, documentation, reporting, and compliance structures are in place and functioning.
- Seeks to increase safety in the workplace.
- Is concerned about process safety management.
- Uses risk data to generate insights and drive strategic decisions.
- Provides regular updates to stakeholders on risk status, trends, and areas requiring attention.
- Is responsible for regulatory, strategic, operational and project risk management.
- Tracks compliance with risk-related policies, procedures, and controls.
- Integrates risk management processes, data, and analytics across the company.
- Maintains accurate, up-to-date records of risk assessments, monitoring activities, and follow-up actions.
- Prepares periodic risk reports that summarize findings, trends, and recommended actions.
Supports the ProcessSupports the Process reflects the enablement, reinforcement, and day-to-day operational support side of Managing Risk by helping embed risk procedures into daily work, ensures employees understand expectations, reinforces adherence to protocols, and aligning team behavior with the organization's risk appetite. Managers supporting the process of Risk Management encourage participation, increase visibility, and help other managers and teams apply risk processes consistently. Their focus is not on owning the risk function but on making the risk process work in practice--supporting adoption, ensuring consistency, and integrating risk thinking into operations.
- Improves process safety where possible.
- Committed to implementing rules and procedures to minimize risk.
- Provides support to managers involved in the risk management process.
- Ensures risk management procedures are consistently applied across teams and workflows.
- Integrates risk management into strategic decision making.
- Ensures risk processes support strategic goals rather than operate in isolation.
- Ensures employees are aware of potential impacts by increasing risk visibility.
- Works within constraints of the organization.
- Supports cross-functional teams in applying consistent risk practices.
- Aligns team activities with the organization's risk appetite and tolerance levels.
- Encourages employees to raise concerns and participate in risk-related discussions.
- Reinforces adherence to risk protocols during daily operations, not just during formal reviews.
Risk CommunicationRisk Communication focuses on sharing information, setting expectations, and ensuring clarity across the organization by translating risk policies into understandable guidance, clarifying roles and procedures, and keeping stakeholders informed through reports, updates, and cross-department communication. The emphasis is on creating transparency--making sure people know what the risks are, what the protocols require, and how decisions are being made. They build shared awareness and alignment so that everyone understands their part in managing risk. Risk Communication is about informing, clarifying, and connecting people to the risk management system.
- Maintains open communication with other departments.
- Ensures documentation meets regulatory, audit, and organizational standards.
- Fosters an awareness and a shared responsibility for managing risk at all levels of the Company.
- Presents regular/monthly reports to the audit committee.
- Promotes risk management competence throughout the organization.
- Ensures that risk monitoring results are communicated in a way that supports informed decision-making.
- Establish roles, responsibilities, procedures.
- Communicates the protocols.
- Communicates risk policies into clear, actionable steps for employees.
- Clarifies expectations when new or updated risk procedures are introduced.
TrainingTraining focuses on building capability, developing skills, and improving performance related to risk through teaching employees how to apply risk procedures, coaching them on decision-making, and creating materials or sessions that strengthen risk competence. Managers with this competency identify knowledge gaps, design training based on incidents or audits, and ensure employees have the skills and resources to follow risk protocols effectively. Their emphasis is on learning and development--helping people not just understand risk, but perform better in managing it. Training is about teaching, developing, and equipping employees to act effectively within the risk framework.
- Offers training to reduce safety incidents in the workplace.
- Is knowledgeable of standard risk management principles.
- Attends risk management seminars and conferences.
- Creates informative guides regarding potential risks and risky behaviors.
- Identifies gaps or inefficiencies in existing risk processes and recommends appropriate training.
- Coaches team members on how to incorporate risk considerations into their own decision-making.
- Provides training and resources to help employees follow risk procedures effectively.
- Implements training based on lessons learned from incidents or audits.