Key takeaways
- Risk management is a cycle: identify, assess, treat, then monitor.
- A risk register records each risk, its rating, its owner and the plan.
- Third-party risk, including AI vendors, is a growing part of the job.
- Vendors that state their controls and their gaps clearly are easier to rate.
What a risk manager does
A risk manager runs the company's process for spotting and dealing with risk before it becomes a loss. Each risk is rated by likelihood and impact, then treated in one of four ways: reduce it with controls, transfer it through insurance or contracts, avoid it by not doing the activity, or accept it knowingly.
The tool of the trade is the risk register, a living list of each risk, its rating, its owner and the actions agreed. The risk manager keeps it current, challenges owners whose actions slip, and reports the biggest risks to leadership and the board.
Which risks a risk manager covers
A risk manager covers every category of risk the company has chosen to manage centrally, though larger firms split them across specialists. The main ones are below.
- Operational: failures in processes, people or systems
- Financial: credit, liquidity and market exposure
- Third-party: suppliers, outsourcers and software vendors
- Cyber and information security
- Regulatory and legal
- Reputational and strategic
Risk manager vs director of risk management and enterprise risk manager
A risk manager usually owns one area or runs the register day to day; a director of risk management leads the whole function and its framework. An enterprise risk manager takes the company-wide view, linking risks across departments so leadership sees how they combine.
Above them, larger organisations appoint a chief risk officer who sits on the executive team. In smaller companies the chief financial officer often carries that responsibility, with a single risk manager doing the work.
How a risk manager assesses an AI vendor
A risk manager assesses an AI vendor as a third-party risk: what could go wrong, how likely it is, how bad it would be and what controls bring it down to an acceptable level. The output is a rating and, often, conditions on use.
AI adds a few specific questions. Can the tool act in the outside world without a person agreeing? Can its claims be traced to sources? What happens to company data, and does it train any model? What evidence backs the vendor's security, and which certifications are still pending? A tool can pass with conditions, such as keeping approvals switched on for sending.
What a risk manager means for someone selling
For someone selling, a risk manager is the reviewer who turns vague assurances into a score. They will not be won over by a demo, but they will move quickly when a vendor supplies clear answers, names its controls and is honest about gaps.
Ask your champion early whether a third-party risk assessment applies and how long it usually takes, then send the evidence before the questionnaire arrives.
Where Pebbles Ai fits
- CapabilityAI workspaceA reviewer can test the control directly. Manual, the mode the web app opens in, holds outward actions such as sends, CRM writes and MCP calls for approval; Plan queues them; Auto runs them, except template send and calendar delete.
- CapabilityResearch & analysisResearch comes back with inline numbered citations and a source list, so a reviewer can trace each claim to where it came from.
Common questions
Who does a risk manager report to?
A director of risk management or a chief risk officer in larger organisations, and often the chief financial officer in smaller ones.
What is a risk register?
A list of the risks a company has identified, each with its likelihood and impact rating, an owner and the actions agreed to reduce it. It is reviewed and updated regularly.
Is risk management the same as compliance?
No. Compliance checks that the company follows specific rules, while risk management looks at anything that could cause harm, whether or not a rule covers it. The two work closely together.
About this page. Written by the Pebbles Ai team for people who run sales, marketing and growth. Last updated .
