Occupations and Terms of Reference › Risk manager
Universal terms of reference · POS-027 · version 1.0 · status: draft · next review 2027-10-27
Risk manager
To manage organisational risk, so that risks are identified, owned, controlled and reported to the board before they cause harm.
Each part of this page links to the related trainings, competencies and policies. The links are the same for every facility, so an organisation can see at a glance what a role requires and what it is trained in.
Job description
Job summary. You manage the organisation's risk register. You help teams identify and score risks, make sure each risk has an owner and a control, and report high risks to the board.
Reports to: Chief quality and safety officer.
Leads or supervises: No direct reports.
What you do on a typical day
- Update the risk register with service leads.
- Review new risks from incidents and audits.
- Check that risk controls work.
- Prepare the quarterly risk report for the board.
- Support risk workshops.
Working conditions and demands
- Works across all functions.
- Needs to challenge optimism without blocking work.
- Handles sensitive information.
What good looks like
- Every risk has an owner and a control.
- High risks are reported to the board.
- Controls are tested.
Place in the organogram
Reporting line, from the top: see the organogram on the Occupations page. The lines above and below this role are listed in section 3.
1. Golden rules
These rules apply in every setting.
- Every decision that affects patient safety is made on evidence and recorded.
- Quality means the patient's experience as well as the clinical result; both are measured.
- Problems are reported early and without blame, and learned from.
- Standards are followed the same way on every shift and at every site.
- Every staff member can raise a concern without fear of reprisal.
- Improvement work is planned, measured and kept going until it is embedded.
- Data is used to improve care, and is protected while it is used.
- Where a standard cannot be met, the gap is recorded and escalated the same day.
2. Identification
| Item | Detail |
|---|---|
| Position code | POS-027 |
| ISCO-08 | 1219 (skill level 4) |
| ESCO | to map |
| Department | Quality and safety |
| Facility types | Hospital, Ambulatory, Transport, Medevac, Fitness, Aesthetic |
3. Reporting line and working relationships
Reports to: POS-008. Supervises: .
| Works with | Nature of the relationship |
|---|---|
| Chief quality and safety officer | Risk register and board reporting. |
| Internal auditor | Control testing. |
| Chief financial officer | Financial risk. |
4. Key accountabilities
| Domain | Accountability | Evidence of delivery | Checked | Linked competencies | Linked trainings | Linked policies | Standards |
|---|---|---|---|---|---|---|---|
| Risk register | Maintains the organisational risk register. | Register reviewed quarterly | Quarterly | C-01 | T-06 | – | 1 |
| Controls | Checks that risk controls are in place and work. | Control tests recorded | Quarterly | C-02 | T-06 | – | 1 |
| Board reporting | Prepares the quarterly risk report for the board. | Report issued on schedule | Quarterly | C-03 | T-08 | – | 1 |
| Risk culture | Supports teams to identify and report risk. | Risk workshops held | Annually | C-01 | T-06 | POL-INC | 2 |
5. Decision rights
| The post holder decides | Consults or escalates |
|---|---|
| Scoring of risks within the agreed framework | Risks above the board's appetite (CQO and CEO) |
| Format of risk reports | Risks scored above the board's risk appetite (risk manager review) |
6. Qualifications and experience
| ID | Qualification | Mandatory | Validity |
|---|---|---|---|
| Q-01 | Degree in risk management, health management or a related field | Yes | Lifetime |
| Q-02 | Risk management qualification (for example, IRM or national equivalent) | No | Lifetime |
| ID | Experience | Minimum years | Mandatory |
|---|---|---|---|
| E-01 | Risk management or governance experience in a health or regulated service | 5 | Yes |
7. Training requirements
Recommended common practice. Each facility adapts the list to its national law. Essential items apply in every setting; recommended items apply where resources allow.
| ID | Training | Tier | When | Validity | Linked policies | Linked competencies |
|---|---|---|---|---|---|---|
| T-01 | Facility induction | essential | at_entry | Once | POL-WHISTLE · POL-EQUAL · POL-DATA | – |
| T-02 | Safeguarding adults | essential | periodic | Every 3 year(s) | POL-SAFEG | – |
| T-03 | Safeguarding children | essential | periodic | Every 3 year(s) | POL-SAFEG | – |
| T-04 | Data protection and confidentiality | essential | annual | Every 1 year(s) | POL-DATA | – |
| T-05 | Incident reporting and open disclosure | essential | periodic | Every 2 year(s) | POL-INC | – |
| T-06 | Governance, accountability and assurance | recommended | periodic | Every 3 year(s) | – | C-01 · C-02 |
| T-07 | Emergency and major incident command | essential | annual | Every 1 year(s) | POL-INC | – |
| T-08 | Speaking up, inclusion and equality leadership | essential | periodic | Every 2 year(s) | POL-WHISTLE · POL-EQUAL | C-03 |
8. Health, fitness and language
| ID | Requirement | Frequency | Tier | Minimum in low-resource settings |
|---|---|---|---|---|
| H-03 | Fitness-to-work assessment at entry and after serious illness or injury | Every 12 months | recommended | Fitness check at entry |
| Language | Level | Mandatory |
|---|---|---|
| Official language of the country of practice | professional | Yes |
| English | working | Yes |
9. Competencies by level
| ID | Competency | Foundation | Practitioner | Expert | Assessed by | Revalidate | Linked trainings |
|---|---|---|---|---|---|---|---|
| C-01 | Risk identification and scoring | Identifies risks | Scores risks correctly | Designs the risk framework | Risk register audit | Every 12 months | T-06 |
| C-02 | Control design and testing | Checks controls exist | Tests controls | Designs control assurance | Control testing | Every 12 months | T-06 |
| C-03 | Risk reporting to boards | Writes risk entries | Reports risks to managers | Reports risk to the board clearly | Report review | Every 12 months | T-08 |
10. Performance evaluation
- Probation: 6 months, with a sign-off review (recommended value).
- Appraisal: every 12 months against the competencies and indicators below.
| ID | Indicator | Target | Data source | Frequency |
|---|---|---|---|---|
| PI-01 | Risks with owner and control | 100% | risk register | Quarterly |
| PI-02 | Controls tested as planned | 100% | control test log | Quarterly |
| PI-03 | Board risk report issued on time | 100% | board calendar | Quarterly |
| PI-04 | Overdue risk actions | 0 | action tracker | Monthly |
11. Career ladder and promotion
| Level | Role | Minimum experience to move on | Qualifications | Competency minimums | Trainings required | Assessment |
|---|---|---|---|---|---|---|
| Executive | Risk manager | 5 years (recommended) | Q-01 | C-01 expert, C-02 practitioner | T-06 | Executive appointment and performance review |
12. Policies the post holder follows
Each policy is a standard template that the facility adopts and adapts. Templates are maintained centrally, so every facility works from the same version.
POL-SAFEG · Safeguarding adults and children
Purpose: Protect patients from abuse, neglect and harm, and make sure every concern is recognised and acted on.
Scope: All staff, volunteers and contractors.
Key rules:
Scope: All staff, volunteers and contractors.
Key rules:
- Recognise signs of abuse and neglect and record them factually.
- Report every concern to the designated safeguarding lead the same shift.
- Do not investigate alone.
- Share information only as the safeguarding procedure allows.
POL-DATA · Data protection and confidentiality
Purpose: Keep patient and staff information private, secure and used only for care and legal purposes.
Scope: All staff who access records or systems.
Key rules:
Scope: All staff who access records or systems.
Key rules:
- Access only the records needed for your work.
- Keep records secure; do not leave screens or paper unattended.
- Do not share information without a lawful basis.
- Report any breach to the data protection officer within 24 hours.
Linked trainings: T-10 · Review every 12 months · Template 0.1 (draft)
POL-WHISTLE · Speaking up (whistleblowing)
Purpose: Let staff raise patient safety or conduct concerns without fear of reprisal.
Scope: All staff.
Key rules:
Scope: All staff.
Key rules:
- Raise a concern with your line manager or the named speaking-up officer.
- If that route fails, escalate to the board or the national regulator.
- Retaliation against anyone who speaks up is a disciplinary offence.
- Concerns are recorded, investigated and the outcome given to the person raising them.
Linked trainings: T-01 · Review every 12 months · Template 0.1 (draft)
POL-EQUAL · Equality, diversity and inclusion
Purpose: Give every patient and colleague fair access, respectful treatment and reasonable adjustments.
Scope: All staff and patients.
Key rules:
Scope: All staff and patients.
Key rules:
- Treat every person with dignity regardless of background.
- Make reasonable adjustments, including interpreters, for language and disability.
- Report discrimination through the speaking-up route.
- Monitor access and outcomes by group.
Linked trainings: T-01 · Review every 24 months · Template 0.1 (draft)
POL-INC · Incident reporting and open disclosure
Purpose: Report and learn from incidents and near misses, and tell patients honestly when things go wrong.
Scope: All staff.
Key rules:
Scope: All staff.
Key rules:
- Report every incident and near miss the same shift.
- Give the patient and family an honest account and an apology where appropriate (open disclosure).
- Take immediate action to protect others.
- Learn: contribute to the review and follow the agreed actions.
13. Standards that name this role
14. Record history
| Date | Change | Approved by |
|---|---|---|
| 2026-10-27 | Draft record, batch 1 of the position build | Awaiting approval |