30-60-90 day plan for risk managers
On this page
- What does a risk manager own that a compliance officer or internal audit does not?
- What does the 30-60-90 day plan look like?
- Which frameworks and rules shape a new risk manager's first 90 days?
- What goes in the first risk register and insurance review?
- Which numbers should a new risk manager baseline?
- What does "on track" look like at day 30, 60 and 90?
- A filled example
- How should the hiring manager use this plan in the final interview?
- What should the CFO ask at the check-ins?
- What the CFO owes a new risk manager
- Common mistakes
- Adapting the plan
- Questions people ask
A 30-60-90 day plan for a new risk manager should spend the first 30 days reading the risk register, the insurance program and the open claims, and meeting the leaders who own the biggest risks; days 31-60 refreshing the risk assessment with those owners and getting control of the next insurance renewal; and days 61-90 delivering a first risk report to the board or committee with owners, ratings and dated actions. As of November 2026, the outline most U.S. companies use is COSO's enterprise risk management framework, and the IIA's updated Statement of Position on the Three Lines Model, published July 8, 2026, is the clearest description of where the risk function sits next to management and internal audit.
This page is for the CFO, general counsel or chief risk officer hiring a risk manager or enterprise risk manager in a company, including a role that also runs the corporate insurance program. The compliance program and the hotline are in the 30-60-90 day plan for compliance officers; cyber risk and incident duties in the 30-60-90 day plan for CISOs; workplace hazards and OSHA logs in the 30-60-90 day plan for safety managers; and the board and finance roadmap in the 30-60-90 day plan for CFOs. Nothing here is legal or insurance advice.
What does a risk manager own that a compliance officer or internal audit does not?
| Area | Risk manager | Compliance officer | Internal audit |
|---|---|---|---|
| Main question | What could stop us meeting our objectives, and is the exposure inside our appetite? | Are we following the laws, regulations and our own code? | Do governance, risk management and controls work as management says? |
| Main output | The risk register, the risk appetite, risk reports, and often the insurance program | Policies, training, the hotline, investigations and the compliance work plan | An audit plan, audit reports and an independent opinion |
| Insurance and claims | Often owns renewals, broker relationship, claims and contract insurance requirements | Rarely | May audit the process |
| Position in the Three Lines Model | Second line, supporting the managers who own the risks | Second line | Third line, independent of management |
The IIA's July 2026 statement says management, the first line, "owns and manages risks," while second-line roles provide "specialized expertise, support, monitoring, and challenge," and internal audit, the third line, gives independent assurance. When internal audit carries out a second-line responsibility, it lists safeguards such as a documented justification, full disclosure to the board and assurance over that area from another independent party (IIA Statement of Position: Three Lines Model). If the company combines risk and audit in one person, settle those safeguards in the offer stage. The 30-60-90 day plan for audit managers covers the third-line view.
What does the 30-60-90 day plan look like?
30-60-90 day plan — [Name], Risk Manager, [company]
Reports to: [CFO / general counsel / CRO] Start date: [date]
Committee: [audit / risk committee] Public or private: [ ]
Insurance program: [N] policies, broker [firm], next renewal [date]
Open claims: [N] Register tool: [GRC tool / spreadsheet]
DAYS 1-30 — Read, map and meet
Goals:
- Read the risk register, risk appetite statement (if any), last
board or committee risk report and the last audit findings
- Build the insurance schedule: policy, carrier, limits,
retentions, premium, renewal date, broker contact
- List open claims with reserves, adjusters and next dates
- Collect contract insurance requirements from the [20] largest
customer, vendor and lease agreements
- Meet the leaders who own the biggest risks, the broker, legal,
the CISO, the safety manager and internal audit
Deliverables by day 30:
- Renewal calendar and open-claims list agreed with [CFO]
- First impressions memo: top [10] risks as the leaders see them
DAYS 31-60 — Refresh the assessment; own the next renewal
Goals:
- Run risk workshops with each owner: cause, impact, likelihood,
current controls, the action and its date
- Agree a rating scale and the appetite for the top risks
- Start the next renewal: exposure data, loss runs, underwriting
submissions and questions with the broker
- Check certificates of insurance against contract requirements
Deliverables by day 60:
- Refreshed register with an owner and a dated action per top risk
- Renewal plan and timeline signed off by [CFO]
DAYS 61-90 — Report and close a gap
Goals:
- First risk report to the board or committee: top risks,
owners, trend, actions, appetite breaches
- Close one gap (example: a lapsed contract insurance requirement,
or an exposure with no insurance and no decision on record)
- Agree the reporting rhythm and key risk indicators per top risk
Deliverables by day 90:
- Board or committee report delivered; reporting calendar agreed
- Two-quarter plan: renewals, workshops, scenario exercises
Check-ins: weekly with [CFO]; reviews at day 30, 60 and 90.Numbers in brackets are examples. Size them to the company's contracts, policy count and committee calendar.
Which frameworks and rules shape a new risk manager's first 90 days?
The items below are stated as of November 2026 from the publishers' and agencies' own pages. The SEC items apply to public companies; the insurance items apply to most employers. State insurance and workers' compensation rules vary, so confirm them for each state where the company operates.
| Item | What applies | Source |
|---|---|---|
| COSO enterprise risk management | Enterprise Risk Management, Integrating with Strategy and Performance, the update of COSO's 2004 framework; five interrelated components supported by 20 principles | COSO; IIA bookstore listing |
| ISO 31000 | ISO 31000:2018, Risk management guidelines; ISO says it "cannot be used for certification purposes" and lists the 2018 edition as to be revised, with a draft (ISO/DIS 31000) under development | ISO 31000:2018 |
| Three Lines Model | Updated Statement of Position published July 8, 2026, replacing the earlier position papers; written for the board as the primary audience | IIA |
| Risk factors (public companies) | Item 105 of Regulation S-K: a "Risk Factors" section on the material factors that make an investment speculative or risky; generic risks go at the end under "General Risk Factors"; a section longer than 15 pages needs a summary of no more than two pages | 17 CFR 229.105 |
| Board risk oversight (public companies) | Item 407(h) requires disclosure of "the extent of the board's role in the risk oversight of the registrant," such as how the board administers that oversight | 17 CFR 229.407(h) |
| Cybersecurity risk (public companies) | Item 106 asks whether and how cybersecurity risk processes "have been integrated into the registrant's overall risk management system or processes," and how the board oversees those risks | 17 CFR 229.106 |
| Terrorism coverage | Treasury says the 2019 reauthorization extended the Terrorism Risk Insurance Program through December 31, 2027, a date to note for property renewals that run past it | U.S. Treasury |
| Retirement plan fidelity bond | ERISA section 412: every person who handles plan funds must be bonded for at least 10 percent of the funds handled, minimum $1,000, generally up to $500,000 per plan, or $1,000,000 for plans that hold employer securities | DOL Field Assistance Bulletin 2008-04 |
| Workers' compensation | Set by each state; Texas, for example, says private employers can choose to carry coverage but "it is not required in most cases," and employers without it must report that to the state | Texas Department of Insurance |
The cyber rules, including incident disclosure, are covered in depth in the CISO plan; the risk manager's part is making sure cyber risk sits in the same register, scale and report as every other top risk, which is what Item 106 asks about.
What goes in the first risk register and insurance review?
A new risk manager usually inherits one of two problems: a register with 200 risks and no owners, or an insurance program that renews on autopilot. Both are fixed with the same short fields.
| Register field | What good looks like |
|---|---|
| Risk statement | Cause, event and consequence in one sentence ("Because one supplier makes 70 percent of part X, a plant outage there would stop our assembly line for weeks") |
| Owner | A named business leader, not the risk manager |
| Rating | Likelihood and impact on the company's agreed scale, before and after current controls |
| Treatment | Accept, reduce, transfer (insurance or contract) or avoid, with the decision recorded |
| Action and date | One next action with a date, reviewed at each report |
| Indicator | A key risk indicator that would show the risk is growing |
The insurance review asks three questions of every policy: which risks in the register it transfers, which contracts require it, and when it renews. A risk marked "transfer" with no policy behind it, or a contract requirement no policy meets, is the first gap to close.
Which numbers should a new risk manager baseline?
The measures are examples. Agree the definitions with the CFO in month one and track them from the first report.
| Measure (examples only) | What it shows |
|---|---|
| Top risks with a named owner and a dated action | Whether the business owns its risks |
| Actions past their date, by owner | Whether the register is used or only filed |
| Total cost of risk: premiums, retained losses and risk administration costs | What risk costs the company each year, and the trend |
| Open claims, reserves and days open | Claim handling and exposure in the retention |
| Contracts with insurance requirements not met by current policies | Breach and uninsured liability exposure |
| Days before renewal that submissions go to the market | Whether renewals are run or rushed |
What does "on track" look like at day 30, 60 and 90?
| Checkpoint | On track | Worth a direct conversation |
|---|---|---|
| Day 30 | Renewal calendar and open-claims list built; leaders met; top risks listed in their words | A new framework document drafted before anyone was interviewed |
| Day 60 | Every top risk has an owner, a rating and a dated action; the next renewal is on a timeline | The risk manager is listed as owner of most risks; renewal data still missing |
| Day 90 | First committee report delivered; one gap closed; indicators agreed | A heat map with no actions; a report the committee could not use |
A filled example
Risk manager: Dana Whitfield (invented), joining a private, mid-size food manufacturer with four plants as its first full-time risk manager, reporting to the CFO. All details are examples.
Day 30: The register had 140 risks, most owned by "management." The insurance schedule she built showed the property policy renewing in ten weeks with values not updated for a new plant, and two customer contracts requiring product recall coverage the company did not carry.
Day 60: Workshops with plant and supply chain leaders cut the register to 18 top risks, each with an owner. A single-source packaging supplier rose to the top. The broker took updated values and loss runs to market six weeks before renewal, and the CFO approved quotes for recall coverage.
Day 90: The audit committee got a two-page report: top risks, owners, trend and actions. The recall gap was closed at renewal, the supplier risk had a qualified second source on a timeline, and each top risk had one indicator to report quarterly.
How should the hiring manager use this plan in the final interview?
Give every finalist the same brief: a disguised extract of the register, the insurance schedule with renewal dates, and one known problem. Score the plans with the rubric in how to evaluate a 30-60-90 day plan in an interview. A strong plan puts owners on risks before it redesigns the scale, and treats the next renewal as a deadline rather than a background task. Questions that test it:
- "A leader refuses to own a risk that sits in their area. What do you do?"
- "The property policy renews in ten weeks and the values are a year old. Walk me through the next ten weeks."
- "A customer contract requires coverage we do not carry. Who decides, and what are the options?"
- "What would you put on one page for the audit committee in your first report?"
The interview questions for risk management test the underlying judgment in earlier rounds, including a ten-minute pre-mortem exercise that fits a risk manager loop well.
What should the CFO ask at the check-ins?
- Day 30: What renews in the next six months, and is anything uninsured that should not be? Which risks do leaders worry about that are not in the register?
- Day 60: Which top risks still have no owner? What will the next renewal cost, and why?
- Day 90: What did the committee ask that we could not answer? Which gap did you close, and what is next?
What the CFO owes a new risk manager
- Access to the board or committee, with an agreed date for the first report.
- Leaders' time for workshops in month two, asked for by the CFO, not the new hire.
- The broker relationship handed over formally, with loss runs, prior submissions and claim files.
- A copy of every contract with insurance or indemnity terms, or a way to find them.
- The history: past large losses, coverage disputes and risks the company chose to accept.
Common mistakes
- Owning the risks. A risk manager who owns every risk owns none; the business must.
- A longer register. More risks is not more control; a short list with actions is.
- Treating insurance as a separate job. Policies should map to risks marked "transfer" in the register.
- Starting the renewal late. Underwriters need current exposure data and loss runs weeks before the date.
- Reporting a heat map. Committees need owners, trends and decisions, not colors.
Adapting the plan
- Public companies: add the risk factor review with legal before the annual report, and align the register's top risks with the Item 105 and Item 106 disclosures and the board's oversight description under Item 407(h).
- Banks and insurers: risk management is shaped by the prudential regulator's rules and exam findings; add the regulator's latest findings and the credit, market, liquidity and operational risk owners to month one. The 30-60-90 day plan for credit analysts shows how credit risk ratings work underneath.
- Insurance-heavy roles: weight months one and two toward renewals, claims and contracts, and add the workers' compensation program in each state.
- Credentials: The Institutes' Associate in Risk Management (ARM) is three courses plus ethics, with timed online exams of 50 questions in 65 minutes; the RIMS-CRMP is valid for two years and needs 50 continuing education points per cycle, as of November 2026.
Questions people ask
What should a new risk manager do in the first 30 days?
Read the existing risk register, the last board or committee risk report, the insurance schedule with every policy's limits, retentions and renewal date, the open claims list and the contracts that require the company to carry insurance. Then interview the leaders who own the largest risks and the insurance broker. The month ends with a renewal calendar, a list of open claims with owners, and a first view of the top risks that the CFO agrees with.
Which framework should a risk manager use for enterprise risk management?
Most U.S. companies use COSO's Enterprise Risk Management framework, Integrating with Strategy and Performance, which has five interrelated components and 20 principles, or ISO 31000:2018, Risk management guidelines. ISO says ISO 31000 cannot be used for certification, and as of November 2026 it lists the 2018 edition as to be revised, with a new draft under development. The framework matters less than a register the business actually owns and reviews.
What is the difference between a risk manager and a compliance officer?
A risk manager helps the business identify, size and treat all kinds of risk, including strategic, operational, financial and insurable risks, and often runs the insurance program and claims. A compliance officer owns the program that keeps the company within laws, regulations and its own code of conduct, including the hotline and investigations. In the IIA's Three Lines Model both usually sit in the second line, with internal audit providing independent assurance as the third.
How do you measure a risk manager's first 90 days?
By whether every top risk has a named business owner, a rating and agreed actions with dates; whether the insurance renewal calendar and open claims are under control; whether the board or committee received a clear first risk report; and whether one concrete gap was closed, such as a lapsed contract insurance requirement or an uninsured exposure. The number of risks in the register is not a measure of quality.