Role: Risk Manager

Document ID: SW-IMS-ROLE-007-v1.0
Effective Date: [TBD]
Review Date: [TBD]
Reports to: CEO
Current Assignment: [TBD - Name to be assigned by management]

Role Summary

The Risk Manager is responsible for coordinating Swedwise AB's enterprise risk management activities across all domains, including quality, environmental, information security, and business risks. The Risk Manager ensures a systematic, integrated approach to risk identification, assessment, treatment, and monitoring in support of Swedwise's strategic objectives and ISO certification requirements.

This role works closely with the IMS Owner, CISO, Quality Lead, and Environmental Lead to ensure risk management is embedded throughout the organization and supports informed decision-making.

Time Allocation

• Implementation Phase: 15-20% of working time
• Ongoing Operations: 10-15% of working time
• Risk Assessment Cycles: Up to 25% of working time (quarterly/semi-annually)
• During Major Changes: Variable (as needed)

This is a part-time functional role designed to be combined with other operational responsibilities appropriate to Swedwise's size (~35 employees). This role can potentially be combined with CISO, IMS Owner, or Quality Lead, depending on organizational structure.

Key Responsibilities

1. Enterprise Risk Management Framework

• Establish and maintain the enterprise risk management (ERM) framework
• Ensure risk management aligns with ISO 31000 principles and IMS requirements
• Define risk management methodology, criteria, and processes
• Integrate risk management across quality, environmental, and security domains
• Promote risk-based thinking throughout the organization
• Maintain risk management policy and procedures
• Align risk framework with business strategy and objectives

2. Risk Assessment Coordination

• Plan and coordinate regular risk assessments (at minimum annually)
• Facilitate risk identification workshops with relevant stakeholders
• Ensure consistent application of risk assessment methodology
• Coordinate risk assessments across all IMS domains:
  • Quality risks (customer satisfaction, service delivery)
  • Environmental risks (compliance, aspects, impacts)
  • Information security risks (confidentiality, integrity, availability)
  • Business risks (strategic, operational, financial)
• Document risk assessment results systematically
• Ensure risk assessments cover all relevant contexts and processes

3. Risk Register Maintenance

• Maintain the enterprise risk register as the single source of truth
• Ensure all identified risks are documented with adequate detail
• Track risk status, treatment progress, and effectiveness
• Review and update risk register at least quarterly
• Ensure risk ownership is clearly assigned
• Maintain historical risk data for trend analysis
• Coordinate domain-specific risk registers (ISMS, EMS, QMS)
• Ensure risk register is accessible to relevant stakeholders

4. Risk Analysis and Evaluation

• Facilitate risk analysis using appropriate methods (qualitative/quantitative)
• Assess likelihood and impact of identified risks
• Determine risk significance and priority levels
• Evaluate risk in context of Swedwise's risk appetite
• Consider cumulative and interconnected risks
• Analyze emerging risks and opportunities
• Use risk matrices and scoring appropriate to Swedwise's context
• Provide risk analysis reports to management

5. Risk Treatment Planning

• Coordinate development of risk treatment plans
• Work with risk owners to define treatment actions
• Evaluate treatment options (avoid, mitigate, transfer, accept)
• Ensure treatment plans are realistic and resourced
• Prioritize risk treatment based on risk level and resources
• Document treatment decisions and rationales
• Track implementation of risk treatment actions
• Monitor effectiveness of implemented controls

6. Risk Reporting and Communication

• Prepare risk reports for CEO and Management Team
• Provide risk metrics and KPIs for management reviews
• Present risk dashboards showing current risk profile
• Communicate significant risks and changes to stakeholders
• Report on risk treatment progress
• Escalate critical or emerging risks promptly
• Ensure transparent risk communication throughout organization
• Tailor risk communication to different audiences

7. Risk Monitoring and Review

• Monitor risk environment for changes requiring reassessment
• Track key risk indicators (KRIs) and early warning signals
• Review effectiveness of risk controls and treatments
• Coordinate periodic risk reviews with risk owners
• Monitor external factors affecting risk profile (regulations, market, technology)
• Ensure lessons learned from incidents are incorporated
• Review residual risk levels and determine if acceptable
• Coordinate with internal audit on risk-based audit planning

8. Opportunity Management

• Identify opportunities associated with risks and uncertainty
• Promote opportunity-focused thinking alongside risk management
• Coordinate evaluation of strategic opportunities
• Support decision-making on risk-taking for opportunities
• Track opportunity realization and benefits
• Ensure opportunity management is integrated with risk management

9. Integration with IMS Domains

• Ensure quality risks are integrated into enterprise risk management
• Coordinate with CISO on information security risk assessments
• Work with Environmental Lead on environmental risks and compliance obligations
• Support DPO on privacy risk assessments and DPIAs
• Ensure consistency of risk methodology across domains
• Facilitate cross-domain risk discussions
• Consolidate domain risks into enterprise view

10. Risk Culture and Awareness

• Promote risk awareness throughout Swedwise
• Develop and deliver risk management training
• Foster open discussion of risks without blame culture
• Encourage proactive risk identification by all staff
• Recognize and reward effective risk management practices
• Develop risk communication materials and guidance
• Support "risk champions" within business units

11. Strategic Risk Management

• Identify and assess strategic risks affecting business objectives
• Support management in strategic decision-making with risk insights
• Analyze risks associated with new business initiatives (e.g., SaaS services)
• Monitor competitive and market risks
• Evaluate risks in business development and growth plans
• Assess risks in mergers, acquisitions, or significant partnerships
• Consider scenario planning for significant uncertainties

12. Compliance and Audit Support

• Ensure risk management meets ISO 9001, 14001, and 27001 requirements
• Support internal audits with risk-based audit planning
• Provide evidence of risk management for certification audits
• Coordinate with IMS Owner on audit findings related to risk
• Ensure risk documentation is audit-ready
• Support management review with comprehensive risk reporting

Authority

The Risk Manager has authority to:

Decision-Making Authority

• Approve risk assessment methodology and criteria
• Classify risk severity and determine priority levels
• Require risk assessments for new initiatives or changes
• Recommend risk treatment approaches to risk owners
• Escalate risks that exceed defined risk appetite
• Request information and cooperation from all business units
• Facilitate risk-based decision-making processes

Escalation Authority

• Escalate critical risks directly to CEO and Management Team
• Require immediate attention to unacceptable risks
• Invoke risk escalation procedures
• Call for emergency risk reviews when warranted
• Recommend suspension of activities with unacceptable risk (subject to management approval)

Resource Authority

• Request resources for risk assessments and treatment implementation
• Recommend resource allocation for critical risk mitigation
• Engage external risk consultants or specialists (within approved budget)
• Prioritize risk treatment initiatives

Limitations

• Risk treatment decisions ultimately rest with risk owners and management
• Major expenditures require CEO approval
• Risk acceptance decisions above defined thresholds require management approval
• Cannot override operational authority of business unit leaders
• Provides recommendations; final business decisions rest with management

Required Competencies

Education and Qualifications

Minimum:

• Bachelor's degree in Risk Management, Business, Finance, IT, or related field
• OR equivalent practical experience in risk management or related field (3+ years)

Preferred:

• Formal risk management training
• ISO 31000 or enterprise risk management certification
• Understanding of ISO 9001, 14001, and 27001 risk requirements

Professional Certifications (Recommended)

Highly Recommended:

• ISO 31000 Risk Management certification
• Certified Risk Management Professional (CRMP or similar)
• ISO 27001 Lead Auditor or Lead Implementer (for security risk context)

Valuable:

• Project Risk Management (PMI-RMP or similar)
• Business Continuity certification (ISO 22301)
• Internal auditor certification (ISO 19011)
• CISM or CISSP (for information security risk)
• Lean Six Sigma (for process risk and improvement)

Experience

Essential:

• Minimum 3 years experience in risk management or related field
• Understanding of risk assessment methodologies
• Experience with risk registers and risk tracking systems
• Knowledge of ISO management system requirements
• Experience facilitating workshops and stakeholder engagement

Desirable:

• Previous involvement in ISO certification project (risk aspects)
• Experience in IT consulting or SaaS environment
• Information security risk assessment experience
• Project or program risk management experience
• Experience with scenario planning or business continuity
• Internal audit experience

Skills and Competencies

Risk Management Skills:

• Risk identification, analysis, and evaluation techniques
• Risk treatment planning and monitoring
• Quantitative and qualitative risk assessment
• Risk modeling and scenario analysis
• Risk metrics and KPI design
• ISO 31000 principles and framework

Analytical Skills:

• Data analysis and interpretation
• Statistical analysis and probability assessment
• Trend identification and forecasting
• Root cause analysis
• Systems thinking and interconnected risk analysis
• Critical thinking and problem-solving

Communication Skills:

• Excellent written and verbal communication in English and Swedish
• Ability to communicate complex risks simply
• Facilitation and workshop leadership
• Presentation skills for management audiences
• Stakeholder engagement and influencing
• Conflict resolution and negotiation

Organizational Skills:

• Process documentation and standardization
• Project and program coordination
• Multi-tasking and priority management
• Attention to detail and thoroughness
• Change management

Personal Attributes

• Objective and independent mindset
• Strategic thinker with attention to detail
• Comfortable with uncertainty and complexity
• Analytical and methodical
• Diplomatic and tactful when raising difficult issues
• Proactive and anticipatory
• Collaborative and team-oriented
• Continuous learner on risk topics
• Calm under pressure when dealing with crises
• Pragmatic and solution-oriented

Key Relationships

Stakeholder	Nature of Interaction	Frequency
CEO	Reports to; escalates critical risks; provides risk insights	Bi-weekly
Management Team	Risk reporting; strategic risk discussions; decision support	Monthly
IMS Owner	Coordinates IMS risk management; joint management reviews	Weekly
CISO	Information security risk assessments; security risk treatment	Weekly
Quality Lead	Quality risk identification and management	Bi-weekly
Environmental Lead	Environmental risks and compliance obligations	Bi-weekly
DPO	Privacy risks and DPIA support	As needed
Risk Owners	Risk assessment, treatment planning, monitoring	Monthly
Department Managers	Departmental risk identification and management	Quarterly
Project Managers	Project risk assessments and management	As needed
Internal Auditors	Risk-based audit planning; audit coordination	During audits
External Auditors	Evidence of risk management for certification	During audits
Insurance/Brokers	Risk transfer options; insurance coverage	Annually

Relationship with Other IMS Roles

IMS Owner

• Collaboration Model: Risk Manager provides risk expertise; IMS Owner coordinates overall IMS
• Division of Responsibility: Risk Manager owns enterprise risk methodology and coordination; IMS Owner ensures risk processes are integrated into IMS
• Interaction: Weekly coordination; joint management review preparation; shared audit activities
• Note: Can be combined with IMS Owner role for organizations of Swedwise's size

CISO (Chief Information Security Officer)

• Collaboration Model: Risk Manager coordinates overall risk; CISO owns information security risk
• Division of Responsibility: Risk Manager maintains enterprise risk register; CISO conducts detailed security risk assessments and owns risk treatment
• Interaction: Close collaboration on security risks; security risks feed into enterprise risk register
• Note: Can be combined with CISO role if appropriate competencies exist

Quality Lead

• Collaboration Model: Complementary roles addressing different risk domains
• Division of Responsibility: Risk Manager provides risk methodology; Quality Lead identifies and manages quality risks
• Interaction: Regular coordination on customer and service delivery risks

Environmental Lead

• Collaboration Model: Complementary roles addressing different risk domains
• Division of Responsibility: Risk Manager provides risk methodology; Environmental Lead identifies and manages environmental risks
• Interaction: Coordination on environmental compliance and operational risks

DPO (Data Protection Officer)

• Collaboration Model: Complementary roles with overlap on privacy risk
• Division of Responsibility: Risk Manager integrates privacy risks into enterprise view; DPO conducts DPIAs and manages privacy risks
• Interaction: Privacy risks are escalated to enterprise risk register; coordinated approach to data breach risk

Performance Indicators

KPI	Target	Measurement Method
Risk Register Currency	100% of risks reviewed quarterly	Risk register review dates
Risk Assessment Frequency	Minimum annual enterprise risk assessment	Assessment schedule tracking
Risk Treatment Progress	80% of treatment actions completed on schedule	Treatment plan tracking
Critical Risk Escalation	100% of critical risks escalated within 24 hours	Escalation records
Risk Reporting Timeliness	100% of management reviews include risk report	Management review minutes
Risk Owner Engagement	90% of risk owners actively managing their risks	Risk owner survey/assessment
Risk Awareness Training	100% of managers trained in risk management	Training records
Incident to Risk Learning	100% of significant incidents result in risk review	Incident register cross-reference
Risk Audit Findings	Zero major findings on risk management in audits	Audit reports
Residual Risk Acceptance	100% of residual risks formally accepted by appropriate authority	Risk acceptance register

Delegation and Backup

During Planned Absence

Responsibilities are delegated in the following manner:

• Critical risk escalations: Directed to CEO or IMS Owner
• Routine risk monitoring: Delegated to IMS Owner or CISO (pre-designated)
• Risk register maintenance: Delegated to IMS Owner or designated coordinator
• Risk assessments: Can be rescheduled for short absences; CISO or IMS Owner for urgent needs

Deputy Role

A deputy Risk Manager should be designated from:

• IMS Owner (most likely)
• CISO
• Quality Lead
• Senior manager with risk management experience

The deputy should:

• Receive appropriate risk management training
• Participate in risk assessments to gain experience
• Have access to risk register and documentation
• Understand escalation procedures and risk appetite

Success Factors

The Risk Manager will be successful when:

1. Risk Visibility: Management has clear visibility of key risks and emerging threats
2. Informed Decisions: Business decisions are made with full understanding of associated risks
3. Proactive Culture: Risks are identified and addressed proactively, not reactively
4. Integration: Risk management is naturally embedded in business processes
5. Effective Treatment: Risk treatment actions demonstrably reduce risk exposure
6. No Surprises: Significant incidents were identified as risks and mitigated where possible
7. Compliance: Risk management meets all ISO requirements without creating bureaucracy
8. Communication: Risk information flows freely and is understood at all levels
9. Opportunity: Risk management enables opportunity-taking with eyes open
10. Maturity: Risk management maturity improves over time

Document Control

Version	Date	Author	Changes
1.0	[TBD]	[Author]	Initial release

---

Approval

Role	Name	Signature	Date
CEO
Management Team