Your First 90 Days as an Enterprise Risk Manager: A Strategic Playbook

The Enterprise Risk Manager’s First 90 Days: Why This Moment Matters 

You’re stepping into one of the most critical roles in your organization. The Enterprise Risk Manager isn’t just another compliance function—you’re building a strategic capability that shapes how your organization makes decisions, allocates resources, and manages uncertainty. 

Here’s what many new ERM leaders discover early on: Your first 90 days won’t be about mastering every risk framework. They’ll be about establishing yourself as a credible strategic partner that people actually want to listen to. 

The reality is this: Your first 90 days are an opportunity to establish yourself as a credible strategic partner to the business, understand how risk is currently managed, and position the enterprise risk function for influence and impact. Get this foundation right, and the next 18 months are yours to shape. Take time to understand the landscape first, and you’ll build lasting credibility. 

The Three-Phase Framework: How Successful ERM Leaders Spend Their First 90 Days 

Successful ERM onboarding follows a clear architecture: listen, diagnose, and execute. Each phase builds on the last and creates momentum toward strategic impact. 

Phase 1: Listen and Learn (Days 1-30) 

Your first month is best spent in observation and genuine curiosity. This is where many new risk leaders find their greatest insights. 

Spend your first 30 days scheduling one-on-one meetings with critical stakeholders: your CFO, CEO, board risk committee chair, Chief Audit Executive, CISO, Chief Compliance Officer, and your direct reports. Ask the same questions to each: What are your biggest operational risks? What keeps you up at night? How effective is our current risk management approach? What would you want the risk function to do differently? 

Document the emerging themes. The risks and frustrations that are mentioned repeatedly by different stakeholders are often good indicators of where you can have the most impact. Those areas also tend to have natural stakeholder support for improvement. 

While you’re meeting with stakeholders, take time to understand your current state. Do you have a centralized risk register? Is it current? Who owns it? Review board minutes and risk committee agendas from the past two years. What risks have been discussed repeatedly? Which ones have escalated or diminished? 

The key insight from this phase: You’re building a foundation for understanding. The stakeholders who consistently mention the same risk problems can become your allies as you move forward. 

Phase 2: Diagnose and Design (Days 31-60) 

By day 31, you’ve listened and learned. Now you have the opportunity to synthesize what you’ve discovered into a clear diagnosis and strategic plan. 

Start creating a 90-Day Insights Memo addressed to your leadership. This document should include the current state of enterprise risk management (strengths and opportunities for improvement), the three to five highest-impact risks facing the organization, the operational blind spots in how risk is being managed today, your proposed priorities for the first 12 months, and what you need from leadership to succeed. 

This memo serves three important purposes: It demonstrates that you’ve done your homework. It establishes your voice and perspective. It creates alignment with leadership on what matters. 

During this phase, you’ll also evaluate your risk governance structure. Map who owns each major risk category. Identify whether accountability is clear or if risk responsibility is spread across multiple areas. Understand the cadence of risk reporting to the board and executive leadership. Find out whether policies and procedures are documented or if risk management happens more organically. 

It’s also valuable to identify one meaningful initiative you can deliver in the next 30 days. This might be consolidating the risk register and publishing a unified enterprise risk report, establishing a monthly risk committee meeting cadence with documented decisions, creating a risk heat map showing the organization’s top 10 risks, or mapping third-party risk across the organization. 

This initiative gives you an opportunity to demonstrate competence and build momentum early on. 

Phase 3: Establish and Execute (Days 61-90) 

By day 61, you’ve learned the landscape and designed your approach. Now you have the chance to operationalize it. 

Launch your initiative and deliver visible results. Establish a regular governance cadence with monthly risk committee meetings where executive leadership discusses top risks, quarterly board risk committee presentations, and bi-weekly risk team meetings where your direct reports stay aligned. Create a 12-month strategic roadmap that addresses governance and accountability, data and visibility, risk assessment and monitoring, technology modernization, and capability building. 

By day 90, present your assessment to leadership. Share your 90-day accomplishments, your 12-month roadmap, what success looks like, and how you’ll measure it, and what you’ll need from them to move forward (budget, headcount, technology, executive support). 

Building Credibility: The Critical Stakeholder Relationships 

Your success depends on building strong relationships with stakeholders across your organization. Each person you work with has different priorities and values, and understanding those helps you communicate in ways that resonate with them. 

The Chief Financial Officer controls the budget and often champions enterprise risk initiatives. They care deeply about financial risk and regulatory compliance. Position risk management to reduce financial volatility, protect the balance sheet, and satisfy regulators and auditors. 

The CEO plays a central role in shaping the organization’s risk culture and translating board-approved risk appetite into strategic decisions. They’re often focused on enabling growth and competitive advantages. Frame risk management as supporting strategic initiatives while managing downside effectively. 

The Chief Audit Executive audits your controls and sees patterns across the organization. Creating alignment on priorities and avoiding overlap with audit functions helps everyone work more efficiently. Sharing emerging risk insights with them strengthens both functions. 

The Chief Information Security Officer owns cyber risk, which is increasingly important to operational and strategic risk management. Integrating cyber risk into enterprise risk assessments and creating a feedback loop between threat intelligence and your risk register creates value for both functions. 

The Board Risk Committee Chair sets expectations for risk reporting and governance. Understanding what the board needs and delivering it consistently builds trust and influence. 

At the operational level, business unit leaders own operational risk and control processes. Positioning yourself as a partner in managing their operational risks—rather than as an outside constraint—helps you build meaningful relationships. The Chief Compliance Officer overlaps significantly with risk management, so integrating compliance into enterprise risk management helps avoid duplication and creates a more cohesive function. The General Counsel owns legal risk and manages regulatory relationships—including them in risk escalation, and board-level discussions strengthens governance. 

Five Critical Conversations Every New ERM Leader Should Have 

Before you set your 12-month roadmap, having clarity on five key topics helps you align your efforts with organizational priorities. 

What is our risk appetite? Many organizations haven’t articulated this explicitly, but asking the question helps surface important assumptions. Push gently for specificity: Are you willing to accept a 5% probability of a $10 million operational loss? How much downtime can you except for critical systems? What’s your tolerances for regulatory fines? Without a clear sense of risk appetite, it’s difficult to prioritize effectively. 

Who owns enterprise risk management? Clarifying governance helps everyone understand their role. Map ownership explicitly so accountability is clear rather than diffuse. 

What does the board expect to see from the risk function? Asking your board risk committee chair and the CFO about reporting frequency, format preferences, what decisions they expect to make based on risk reporting, and what escalation thresholds trigger immediate board notification helps you deliver what’s needed. 

Do we have a unified view of enterprise risk? Many organizations have risk data spread across different systems and spreadsheets. Understanding this landscape early helps you identify where you can improve visibility and create value. 

What authority do I have? Being clear about this early prevents misunderstandings later. Can you set risk policies? Can you require risk assessments before major decisions? What budget and headcount do you control? Understanding these boundaries helps you operate effectively. 

Approaches That Help New ERM Leaders Succeed 

Starting with observation rather than action gives you the foundation to make good decisions later. Listening first helps you understand the organization’s culture and constraints. 

Focusing on the highest-impact areas is more effective than trying to improve everything at once. Identifying the 3-5 priorities that matter most allows you to move thoughtfully. 

Connecting risk to business outcomes helps stakeholders see the relevance of risk management. Framing cyber risk in terms of customer trust and revenue, operational risk in terms of efficiency and cost, and strategic risk in terms of growth and competitive position makes risk conversations more meaningful. 

Building relationships before you need them pays dividends later. Coffee meetings, informal check-ins, and genuine interest in colleagues’ work create a foundation of trust and goodwill. 

Taking time to understand organizational culture and adapting your approach accordingly helps you influence more effectively. If your organization values speed and innovation, excessive formality can backfire. If it values tradition and stability, moving too fast can create resistance. 

Investing in a unified technology platform allows you to focus on strategy rather than manual data wrangling. A platform that integrates risk data, enables workflow automation, and provides analytics gives you more time to focus on what matters most. 

What Success Looks Like After 12 Months 

By the end of your first 12 months, you’ll have established credibility where you’re invited to strategic discussions and leaders trust your judgment. You’ll have implemented governance where risk is managed deliberately, and accountability is clear. The organization will have improved visibility into enterprise risk. You’ll have driven impact through initiatives that have strengthened controls or enabled strategic growth with better risk awareness. Your team will be aligned, capable, and growing. Most importantly, risk management will be viewed as a value-add that helps the organization succeed. 

Ready to Hit the Ground Running?

This blog covers the strategic framework, but there’s more to explore. Download our comprehensive guide to get detailed checklists, conversation templates, and deeper insights into building a high-impact ERM function from day one.