Baby boomers are retiring, and with them goes their vast experience. But instead of welcoming in a new wave of ambitious young recruits, we face a skills shortage. How will the industry encourage the next generation of talent to come in and make this evolving role their own?

After decades of professional dominance and leadership, baby boomers are now outnumbered by millennials in the workplace.

While such a transition was inevitable, it might have especially impactful consequences for the risk management industry.

vacant skills gap job

In the US, 68% of risk managers are over 40. Just 6% are between 20 and 30, according to Zippi.

In the UK, research by Generation Logistics found that the most desirable careers were in the media and internet, followed by healthcare.

The 2022 Hays Asia Salary Guide found that 40% of organisations reported a concerning lack of confidence in their ability to hire the skilled talent they need.

For the risk management industry, this creates a worrying shift. As risk managers with vast experience retire, the struggle to find the next generation makes gap-plugging difficult.

The recruitment challenge

Fiona Davidge, head of corporate risk at the House of Commons within the UK Parliament, says that as with many specialist professions, it is not easy to find, recruit and retain competent, knowledgeable and experienced risk professionals.

“It is still not a very visible professional route for young business-oriented people to go into and many organisations do not as yet employ qualified risk professionals,” she explains.

“If you look at the limited number of degrees with ‘risk’ in their title, they vary in content, with several linked to disaster management or the finance profession. There is only one degree with the more open title ‘risk management’.”

Davidge says there is a fundamental divide in the risk profession between those employed in the finance sector and orientated to financial risk and those working elsewhere.

  • 68% of risk managers in the US are over 40 years old
  • 6% are 20–30 years old.

This further restricts movement around the broader profession. “Add these together and you get a reduced pool of talent,” she says.

Clive Thompson, technical adviser, Institute of Risk Management (IRM), says: “There is a skills shortage in most areas driven primarily by demographic change – those leaving the workforce through retirement not being replaced.”

Over in APAC, Steve Tunstall, general secretary of the Pan-Asia Risk and Insurance Management Association (Parima) and CEO of Inzsure, says there is a shortage of many skills across Asia.

“Everything is growing very quickly. Risk management is no exception. One of the challenges is clear definition of the profession. Many of those ‘doing’ risk management still do not have that in their title, or they ‘double-hat’,” he says.

What it takes has changed

Complicating the issue is the broadened skills set required of the modern risk manager. Mushrooming cyber threats, the growing importance of risk culture, the expanded web of risk connectivity.

All elements that suggest what it takes to be a risk manager has rapidly and deeply evolved. “I have been working in the risk management field for over 20 years,” says Davidge.

“The main change I have experienced is the shift from just being aligned with areas such as project management, health and safety, emergency planning and business continuity to broader business planning and strategy areas of the organisation.

”“The modern risk manager needs to be a facilitator and influencer, working with all departments and seniority levels ”

“There has been a move from just viewing risk in the negative and the realisation that you need to take risks to be successful, providing you honestly assess and understand what those acceptable levels of risk are.”

Davidge adds that there is increasing comprehension of the rapidly interconnected nature of the world and therefore the greater velocity and impact of risks.

“The modern risk manager needs to be a facilitator and influencer, working with all departments and seniority levels to understand what risks – positive and negative – can influence the mission and objectives of the organisation.

“Risk managers are now just as typically found within strategy teams as more operationally oriented departments. The ability to articulate risk and risk management in that context to senior leaders, rather than just providing regurgitated risk register data, is key.”

”it is very important that risk managers have an understanding of how to exploit opportunity – this is the only way the risk profession will contribute to top table strategy”

When it comes to the skills the modern risk manager needs, Thompson emphasises the importance of technology skill and the ability to handle data.

He adds: “However, at heart, risk managers need the basic skills of understanding the underlying process operating in the organisation so that risks are assessed correctly.

”Also it is very important that risk managers have an understanding of how to exploit opportunity – this is the only way the risk profession will contribute to top table strategy and debate.”

For Tunstall, the modern risk manager must be an all-round generalist who understands the organisation intimately.

“This is a tall order. The skills required to be successful are diverse and in many organisations, the skill sets look similar to those for a general management specialist. Hence the perceived shortage or challenges in finding a career path,” he says.

Attracting the next generation

Risk management must find a way to retain its best and recruit the next generation. So how can that be achieved?

“By making risk attractive and valuable as an activity young people want to get into,” says Thompson. “Risk-related careers are incredibly diverse, reflecting the widespread role of risk management in companies and communities.

“Risk roles range from banking and insurance to logistics and infrastructure, aviation, space travel, construction, public health, international development and many more. Our members, for example, work at all levels across the public, private and voluntary sectors, in 143 countries.”

“Risk-related careers are incredibly diverse, reflecting the widespread role of risk management in companies and communities.”

Thompson says that awareness of the importance of risk management in the world’s new high-growth economies is increasing. Because of their highly transferable skills, qualified and experienced risk management professionals are able to move easily between different sectors and countries.

Davidge adds that risk management modules should be standard in all business degrees and courses.

“This will upskill all future business managers to consider risk in their activities and act, hopefully, as a catalyst to encourage more people into the profession, having had some exposure to the area,” she says.

With finance and technology continuing to land the best graduates, risk may need a reputational makeover to highlight its career benefits and ensure the industry prospers.

An updated risk manager profile

Beyond basic statistic and analytical skills, which are not a new need for risk managers, a fresh set of skills is needed for the risk manager of the future. Hans Læssø, founder of AKTUS, shares the most important areas to focus on.


This is an internal skill as all business systems differ. The risk manager must understand the business system and the money-making logic of the company to be able to add value.


Decisions are made by human beings who are susceptible to a range of biases, which essentially deplete the factual quality of decisions made. The risk manager must have an understanding of this and how decisions are made within the company to be able to work with it and enhance the quality of decisions.

SOCIAL SKILLS It is time to leave the office and meet people. Talk to executives about their concerns and, more importantly, to specialists. Get the insight – which will also add to your understanding of the company’s business system. Listen and support, and build on their support, to enhance overall company performance. This includes knowing how to work with executives and make them trust you above their immediate gut feeling.

Growing these skills builds trustworthiness and hence affects company performance. Impact, when applied well, adds value and now the risk manager earns their pay to a much greater extent than we often see. This is not a 100-metre sprint. Rather, it’s a Tour de France. And the alternative to competing, for the risk manager, is irrelevance.