Risk Analyst
Smartsuite
A complete application in a minute
Tailored resume and cover letter, ready to send.
Job summary
Capitolis is seeking a Risk Analyst to support the risk program by logging risks, tracking control performance and corrective actions, and turning register data into trend analysis and dashboards.
You will maintain KRIs, connect risks to audit findings, and build dashboards for the risk team, executives and committees, ensuring data accuracy and timely reporting. You will collaborate with Internal Auditor and Compliance Analyst to ensure alignment across risk, controls and assurance activities.
Qualifications
- The Risk Analyst supports the risk program with data: logging risks, tracking control performance and corrective actions, and turning register data into trend analysis and dashboards.
Responsibilities
- Log and categorize risks, incidents and issues in the register
- Support assessment cycles with data collection and scoring validation
- Track control testing, mitigation activity and corrective actions
- Maintain key risk indicator data and threshold alerts
- Build dashboards and trend analyses for the risk team
- Connect risks and controls to audit findings and compliance results
Job description
Governance, risk and compliance
The Risk Analyst supports the risk program with data: logging risks, tracking control performance and corrective actions, and turning register data into trend analysis and dashboards. They keep the register accurate so managers and committees work from reliable information.
Risk Manager
The Risk Analyst supports the risk program with data: logging risks, tracking control performance and corrective actions, and turning register data into trend analysis and dashboards.
- Log and categorize risks, incidents and issues in the register
- Support assessment cycles with data collection and scoring validation
- Track control testing, mitigation activity and corrective actions
- Maintain key risk indicator data and threshold alerts
- Build dashboards and trend analyses for the risk team
- Connect risks and controls to audit findings and compliance results
The GRC processes this role owns, touches and depends on.
accountable for the process
contributes or approves
consumes its output
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Risk Analyst: navy is owned, blue is touched, grey is depended on.
- First line: The business and its control owners. Run the processes, own the controls, fix the issues.
- Second line: Risk, compliance and the domain programmes. Set the frameworks, assess, monitor and advise.
- Third line: Internal audit. Independent assurance to the board and audit committee.
Risk Manager
The Risk Analyst keeps the register accurate enough that the Risk Manager, the committees and the auditors who sample it can trust every score and status. SmartSuite gives structured intake, linked control and issue records and live KRI thresholds, so trend analysis is a view rather than a monthly rebuild.
Risk submissions from the business arrive through a standard form, route through triage and scoring and are categorized on the way in, so the register grows without duplicates or free-text categories. Owners are assigned at intake, not chased later.
Likelihood and impact scoring follows the enterprise methodology in the assessment workflow, so your validation during an RCSA cycle is checking inputs against one scale rather than reconciling five spreadsheets that each scored differently.
Risks such as supply-chain ethics, environmental impact or governance lapses are logged in a structured register with categories and owners, so ESG risk sits in the same taxonomy as operational and compliance risk when the committee reads it.
Control performance, mitigation activity and corrective actions link to the risk they treat, and automated reminders keep the Control Owner to the deadline. Remediation is transparent to you without a status email and auditable afterwards.
Internal audit's findings connect to the risks, controls and KRIs in the register, so when the Internal Auditor rates a finding, the risk it exposes is updated in the same record. Assurance from both lines reads from one file.
Compliance test results and exceptions the Compliance Analyst records link to the same controls, so control effectiveness in the register reflects what compliance found, not what the owner last self-assessed.
Key risk indicators are tracked against predefined tolerance thresholds with automated alerts when a value crosses the line, so the Risk Manager hears about a breach from the system the day it happens rather than at the monthly review.
Heat maps, scoring distributions, mitigation progress and trends are dashboards over the register rather than a chart rebuilt each month. The committee pack draws on them, and the AI Assistant summarizes trends when a narrative is needed.
Every score change, ownership update and mitigation action carries its history, with granular permissions and audit logs on the register. Basel operational risk, ORSA, HIPAA or SOC 2 samples are taken from the system rather than assembled for the request.
Risk management. Logs risks, incidents and issues in a structured register with categories, owners and the enterprise scoring method.
Issues and actions. Tracks testing, control performance and mitigation activity so remediation is transparent and auditable.
Internal audit. Connects risks and controls to internal audit findings for aligned assurance.
Reporting. Builds dashboards showing risk trends, control performance and open actions for the risk team and committees.
Centralize enterprise risk management with standardized assessments, dashboards, and linked workflows that align risk, controls, and mitigation across your organization.
Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real-time visibility into resolution status.
Run risk and control self-assessments with consistent scoring models, evidence on each assessment, and dashboards of risk exposure and control effectiveness.
ISO 31000:2018 and the IRM and RIMS competency frameworks describe the analyst’s work: logging risks, validating scoring, maintaining indicators and producing the reporting committees rely on. The Institute of Operational Risk's KRI guidance covers threshold design.
In banks the register and loss data feed Basel operational risk reporting and must be auditable; in insurers they feed the ORSA. Healthcare analysts support the HIPAA risk analysis and patient-safety reporting; public sector analysts support OMB Circular A-123 risk profiles; technology analysts maintain the risk assessment evidence SOC 2 and ISO/IEC 27001:2022 auditors sample.
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
The Risk Analyst keeps the risk program's data fit to decide on: logging and categorizing risks, incidents and issues in the register, collecting data and validating scoring during assessment cycles, tracking control testing, mitigation activity and corrective actions, maintaining key risk indicator data and threshold alerts, and building the dashboards and trend analyses the risk team and committees use. They also connect risks and controls to audit findings and compliance results, so the register tells one story.
Enterprise Risk Management (ERM) logs risks in a structured register with categories and owners, so every entry carries the category, the owner and the scoring the enterprise method requires. The Risk Analyst validates scores against the method rather than cleaning up free text, and Risk and Control Self-Assessment (RCSA) feeds the first-line assessments into the same structure. An accurate register is the precondition for everything else the role produces.
Issues Management tracks testing, control performance and mitigation activity so remediation is transparent and auditable, which means each corrective action shows its owner, its due date and the evidence that it was done, and each control shows its latest test result. The Risk Analyst follows up with Control Owners from one list of what is overdue, and the Internal Auditor can see the same record when sampling. Nothing about remediation has to be reconstructed for a committee.
SmartSuite connects risks and controls to internal audit findings for aligned assurance, so when the Internal Auditor raises a finding against a control, the risk that control treats shows the finding beside it. The Risk Analyst does not maintain a separate cross-reference between the audit report and the register, and the Audit Analyst and Compliance Analyst work from the same linked records. The result is a register in which risk, control, test and finding line up.
SmartSuite builds dashboards showing risk trends, control performance and open actions for the risk team and committees directly from the register, so the Risk Analyst configures the view once and it stays current as the data changes. Trend analysis over assessment cycles, key risk indicators against their thresholds and the aging of open actions are read from the records rather than exported and charted each quarter. The Risk Manager and the Enterprise Risk Director get the same figures the committee sees.
The current register, however it is kept, the risk categories and scoring scales from the enterprise methodology, the control list with its owners and the open corrective actions. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a risk analyst the first workflow is the register itself, with dashboards following as soon as there is a cycle of data to trend. Teams whose register feeds Basel operational risk reporting or the ORSA match the categories and scales exactly, so the output is auditable from day one.
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
