Author: Drs. Urjan Claassen
In this book, the author discusses risk management in an instructive, practice-oriented manner.
In the introduction, he discusses the difference between a “conformance” and a “performance” motive for transitioning from classical risk management to integrated risk management. However, the concept of “integrated risk management” should be intuitively understood by the reader from the first page as risk management that applies to the entire organization, at all levels. How this can be achieved is further elaborated throughout the book. In my opinion, the concept of the 5 lines of defense is very important:
1A: operational staff, 1B: tactical management, 1C: strategic management.
2: internal audit
3: external audit
4: the accountant
5: regulators.
Furthermore, the introduction presents some shortcomings of COSO, along with how ERMplus provides a solution for these.
What remains particularly noteworthy from this book are the following points:
The importance of a common language of risk management. Without this foundation, the various players cannot understand each other.
That there are psychological and sociological aspects to risk management. These can influence decision-making.
That in addition to the risk matrix for threats, one should also be developed for opportunities.
The enormous importance of audits and how they should be approached. Auditing is a project in itself with its own thorough plan of action to maximize results.
We have our risk management, we have our audit, and now? At the end of the year, the annual report comes with “in-control” statements and a statement of resilience.
Implementation can occur from various starting points, with the five lines of defense becoming important again.
There are different structures possible for oversight: the one-tier and two-tier governance models.
Those who want to develop risk management according to the COSO model will find in the “Handbook Risk Management – ERMplus a practical application of COSO ERM” what they are looking for. It presents a very thorough, heavy-weight approach to risk management, which is very comprehensive.