Risk Management

Christian Horres

Expert in Business Continuity Management (BCM), risk management, and organisational resilience, particularly in the context of critical infrastructures. His focus is on Business Impact Analyses (BIA), risk analyses, and the development and enhancement of BCM and crisis management structures. Within the NOVELEDGE network, he supports organisations in the practical implementation of resilient structures, considering international standards such as ISO 22301, ISO 27001, and ISO 31000, as well as applicable regulations.

Risk Concept

What a Risk Is and What It Is Not

Risk describes the uncertainty regarding objectives. No more and no less. It is not a threat, not a damage, and not an event, but a statement about how far the outcome can deviate from what is intended to be achieved.

This distinction may sound academic, but it determines half the discussion in projects. A power outage is an event. An unencrypted data carrier is a vulnerability. The failure of order acceptance for four hours is damage. The risk is the range of possible outcomes – and it is precisely this range that can be managed.

Two directions are involved: negative deviations are the damage, positive deviations are the opportunity. ISO 31000 explicitly encompasses risk in both directions. In practice, the positive side is almost always omitted – understandable, but incomplete. Those who only look downwards evaluate an investment in new technology solely by its risks and never by what it enables.

The higher the probability of occurrence, the wider this range becomes in both directions. This is why probability of occurrence and impact are always assessed together and never separately.

Risk as a range of possible deviations from objectives: It can lead to negative deviations (damage) or positive deviations (opportunity). Illustration: NOVELEDGE.

Two Perspectives on the Same Challenge

In organisations, risks arise at different levels. Some affect the long-term orientation and viability of the company, while others directly impact daily processes, operations, and resources. To systematically manage these different areas of influence, risk management is often divided into strategic and operational levels. Both perspectives complement each other and contribute to a holistic view and appropriate management of risks.

Strategic Risk Management

Strategic risk management focuses on risks that can influence the long-term development and business model of an organisation. It deals with factors such as market changes, new competitors, technological developments, political frameworks, or major investment decisions. The aim is to recognise in time which developments represent opportunities or risks for strategic orientation, and to make decisions based on this.

Key aspects include the evaluation of external factors, the assessment of the impact of strategic decisions, and the prioritisation of long-term measures. Responsibility typically lies with the management or strategic control levels, as decisions at this level have far-reaching consequences for the entire organisation.

Operational Risk Management

In contrast, operational risk management deals with risks arising in daily business. It encompasses all risks resulting from operations, processes, systems, resources, or internal dependencies. These include, for example, process errors, technical failures, supply bottlenecks, IT system outages, or personnel shortages.

The focus is on early detection of disruptions, assessing their impact on ongoing service delivery, and preparing appropriate measures. Operational risks usually have a short-term and direct impact on the daily functionality of a company. Therefore, specialists, operational managers, and process owners are primarily involved, as they can specifically monitor and control processes.

Practice-Oriented Overview

Risk management in organisations is a structured process to systematically address hazards, uncertainties, and opportunities. It aims to prevent damage, ensure goal achievement, and maintain the ability to act even in crisis situations. The normative basis is primarily ISO 31000^[1]:2018 „Risk Management – Guidelines“, supplemented by industry-specific standards (e.g., ISO 27005 for information security, ISO 22301^[2] for business continuity).

Establishing the Risk Context

Establishing the risk context is the foundation of any risk management process. Here, the following is clarified:

• Internal Context: Goals, strategies, processes, resources, corporate culture.
• External Context: Market conditions, legal requirements, technological trends, geopolitical risks.
• Stakeholders: Expectations of owners, customers, regulatory authorities, the public.

In practice, this means: Only when the framework is clear can risks be correctly classified. A common problem is that organisations view risks only from their own perspective and underestimate external factors.

Risk Identification

In this step, potential sources of danger, threats, and opportunities are systematically recorded. Tools include:

• Checklists and risk catalogues (e.g., for IT, compliance, personnel, production).
• Workshops with executives and experts.
• Analysis of historical incidents (e.g., damage cases, outages, crises).
• Scenario techniques.

Practical problem: Many risk catalogues are static or incomplete. New threats (cyber-attacks, geopolitical shocks, supply chain dependencies) do not appear in them, giving management a false sense of security.

To counter a catalogue that remains static, continuous observation is essential. The monthly resilience report summarises changes in the external situation, prompting a review of one’s own catalogue.

Risk Analysis and Assessment

The analysis is conducted in two dimensions:

1. Probability of occurrence
2. Extent of damage (impact)

This is often represented in a risk matrix, as visualised in ISO 31000. Risks are classified into categories such as „low“, „medium“, „high“, or „critical“.

Additional aspects in practice:

• Accumulation of risks (e.g., several small IT failures lead to a critical overall risk).
• Correlations (a supplier failure leads to production and financial risks).
• Residual vs. gross risk: Assessment before and after measures.

Risk Control / Risk Treatment

Options for dealing with risks include:

• Avoid (cease activities that cause risk)
• Reduce (control mechanisms, emergency plans)
• Transfer (e.g., insurance, outsourcing)
• Accept (consciously bear if measures would be disproportionately expensive)

It is crucial that the measures are documented and reviewed, as they otherwise lose effectiveness in day-to-day operations.

Monitoring and Communication

Risk management is not a one-time project, but a continuous process. Regular reviews, internal audits, reports to management, and open communication with stakeholders are necessary to ensure effectiveness.

Two in-depth topics follow the risk management process. How individual risk assessments can be consolidated across resources, processes, and locations into an enterprise risk is shown in the article on risk aggregation. For operators of critical facilities, risk analysis is also the basis of the resilience plan according to § 13 KRITIS-Dachgesetz.

Governance Structure

From the Three Lines of Defense to the Three Lines Model

The three lines model, developed and recommended by the Institute of Internal Auditors (IIA), establishes a clear distribution of responsibilities^[3]:

• First Line (Management/operational units):
  
  • Responsible for the direct identification and management of risks in day-to-day operations.
  • Examples: Production checks safety standards, IT department implements firewalls, HR ensures compliance in personnel processes.
    
• Second Line (Risk Management & Compliance Function):
  
  • Develops methods, policies, and control mechanisms.
  • Supports operational management with tools (e.g., risk catalogues, reporting systems).
  • Ensures that risks are transparently recorded and assessed according to uniform criteria.
    
• Third Line (Internal Audit):
  
  • Independently audits whether the first two lines are fulfilling their tasks correctly.
  • Reports directly to the board or supervisory board.
    
• External Audit Body (e.g., auditors, regulatory authorities):
  
  • Additionally checks whether laws, standards, and external requirements are being complied with.
    
• Board / Executive Management:
  
  • Bears the overall responsibility for the risk management system.
  • Must be able to rely on the results of all three lines.

Advantage: This model creates transparency and traceability, reduces diffusion of responsibility, and allows the company management to gain a comprehensive overview of the risk situation.

Risk management is a structured, clearly defined process that only works if it:

• is properly anchored in context,
• comprehensively identifies risks (also beyond static catalogues),
• is realistically assessed (including dependencies and correlations),
• is systematically managed and
• is embedded in a clear governance structure.

The Three Lines of Defense model ensures clarity of responsibility and control, so that risk management does not become a mere formality, but an effective tool for corporate security and resilience.

What Has Changed Compared to the Old Model

The depiction above is the familiar one: three lines that operate sequentially. The Institute of Internal Auditors revised this image in 2020 and updated it again in 2026. The roles have essentially remained the same, but the framework around them has shifted.

The 2026 version outlines five principles: The governing body sets purpose and risk appetite. Effective oversight requires reliable, balanced information on performance, risks, and controls. The board and management clearly allocate roles. Multiple independent sources of information enhance trust. And advice complements auditing by providing insight and perspective.^[3]

The Practical Advantage

The difference is not academic. Those who think in terms of lines of defence get demarcation: each line explains what it is not responsible for, and the same question is answered separately in three places. Those who think in terms of roles get a coordinated picture – and the governing body receives information on which it can base decisions.

The IIA identifies four effects when the three lines work together: governance and accountability are strengthened, decisions and performance improve, organisational resilience grows, and trust is built, creating lasting value.

In practice, this means three main things: the second line supports and challenges rather than controls; internal audit maintains its independence without becoming isolated; and the report to the governing body is not a mere formality but the foundation for its decisions. The older term „Three Lines of Defense“ remains common in tenders and job descriptions – today, it generally refers to the Three Lines Model.

Sources

The information in this article is based on the following sources. Paid standards are not quoted verbatim; their contents are summarised.

1. The Institute of Internal Auditors: Assurance and Advice in Support of Effective Governance. Three Lines Model – Statement of Position, 2026. This version replaces the position paper „The IIA’s Three Lines Model“ from 2020, which in turn replaced the „Three Lines of Defense“ model from 2013. Freely available from the IIA. ↑ ↑
2. Hopkin, P. (2018). Fundamentals of Risk Management. Kogan Page. ↑
3. Power, M. (2009). The Risk Management of Nothing. Accounting, Organizations and Society, 34(6-7), 849–855. ↑