In Control or not, that is the question

Integrated Risk Management gives the board one coherent picture of its risks and can thereby strengthen the substantiation of the Risk Management Statement (Verklaring omtrent Risicobeheersing, VOR) under the Dutch Corporate Governance Code (2025). It is not a prerequisite for a well-substantiated statement, but it does make the statement more consistent, more efficient and easier to explain. Etienne Herlaar, Associate Partner Risk Management at ONE Risk Advisory, describes why fragmented Risk Management makes the substantiation harder, why insight alone is not enough and what role Internal Audit plays.

The first VOR season is behind us

Since February 2026, the Corporate Governance Code 2025 has been anchored in law. Through the Risk Management Statement (VOR) in the management report, board members account for the management of operational, compliance and reporting risks, including the reliability of sustainability reporting. The first statements on financial year 2025 have now been published; preparations for the second year are in full swing.

The Netherlands is not alone in this. In the United States, Section 404 of the Sarbanes-Oxley Act (SOx) has for years required a Management’s Report on Internal Control over Financial Reporting (ICFR). In the United Kingdom, Provision 29 of the UK Corporate Governance Code 2024 requires, from financial year 2026, a declaration of effectiveness of material controls, covering operational, reporting and compliance controls as well as financial ones. The message is the same everywhere: the board must be able to substantiate that it is in control.

That statement is outcome-oriented. In the event of inadequate Risk Management or an incorrect statement, the liability of board members comes into view sooner; the practice guide on the VOR by the Institute of Internal Auditors Netherlands (IIA Netherlands) (November 2024) names liability risk as a point of attention when determining the degree of certainty. In addition, the Code also serves as a benchmark for good governance at non-listed organisations.

The challenge: fragmented Risk Management

In practice, the underlying information is often fragmented. Enterprise Risk Management (ERM), financial reporting, asset management, cyber, safety and the CSRD double materiality assessment (DMA) each use their own methodology, their own registers and their own reports. As a result, risks are reported ad hoc and in fragments, while central steering and an explicit risk appetite are missing. The board is accountable, but does not always have an integrated picture.

Growing regulatory pressure

On top of this, regulatory pressure is increasing. Since 15 August 2026, the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw), which implements NIS2, and the Critical Entities Resilience Act (Wet weerbaarheid kritieke entiteiten, Wwke) have been in force. Critical entities must carry out their own risk assessment, and under the Cybersecurity Act the board must approve the duty-of-care measures, oversee their implementation and have sufficient knowledge itself (Article 24 Cbw). Together with the GDPR and the CSRD, all this legislation calls for a risk-based approach. When each obligation is addressed separately, complexity and costs increase further.

Harmonise where possible, differentiate where necessary

A harmonised Risk Management framework brings these worlds together without making them identical. Not every discipline fits the same model: asset management works with failure probabilities and condition data, cyber with threat scenarios and safety with barrier analyses. These differences exist for good reason. The art is to harmonise where possible and to differentiate where necessary.

Harmonisation pays off above all in:

• One risk language and a shared risk taxonomy.
• One rating scale, linked to a risk appetite set by the board.
• Consistent recording of risks, controls, action plans and incidents in a GRC system.
• Integration into management reporting, so that improvement initiatives are directly linked to risk control.

Within that framework, each discipline keeps its own analysis method and professional standard. The result is integrated insight into risks and opportunities, without losing the depth of each specialism.

No overarching standard

There are many different methodologies in the market, but no overarching standard. ISO 31000 and COSO ERM are widely used for Enterprise Risk Management and the COSO Internal Control framework for financial reporting, but other disciplines have their own standards, such as ISO 55000 for asset management and ISO/IEC 27001 or the NIST Cybersecurity Framework for cyber. For the specialisms concerned, these are often untouchable. Which standard ultimately takes the lead is therefore often a political choice.

This is precisely where an independent party creates an opportunity. As a neutral connector between the disciplines, with no stake in any particular methodology, it can help respect the existing standards while arriving at one coherent framework that gives the board integrated insight.

From insight to demonstrable effectiveness

Integrated risk insight is an important step, but not sufficient for the VOR. The statement concerns the operation of risk control: are the key controls properly designed, do they exist and do they actually work effectively? The board must be able to assess and substantiate this.

That calls for a fixed cycle: identifying the key controls for each significant risk; periodically assessing design, existence and operation, for example through self-assessments in the first line and monitoring and testing by the second line; recording and following up shortcomings; and, on that basis, drawing a substantiated conclusion about the degree of certainty. A harmonised framework and a GRC system make that cycle more efficient and the outcomes comparable, but assessing effectiveness remains the core.

The role of Internal Audit

Internal Audit has its own, independent role in this chain. As the third line, Internal Audit provides the board and the audit committee with assurance on the design and operation of risk control, including the assessments carried out by the first and second lines. This is all the more relevant now that, under the Code 2025, the audit committee reports on the substantiation of the VOR. IIA Netherlands sets this out in its Practice Guide VOR en de Internal Auditfunctie.

An integrated framework helps here too. When the first, second and third lines use the same language, rating and recording, their work fits together (combined assurance), duplication is avoided and Internal Audit can rely on or complement what the other lines already do in a targeted way. The condition is that Internal Audit remains independent of the set-up it assesses.

What it delivers

Integrated insight, demonstrable effectiveness and independent assessment enable the board to issue the VOR with more comfort and to inform stakeholders in the annual report in an integrated way about the effectiveness of risk control. At the same time, duplication and hidden costs disappear: when everyone does Risk Management in their own way, costs are high and the overview is limited.

A central steering model requires an upfront investment, but delivers structural efficiency and increases certainty about achieving the strategic objectives. New legislation can also be connected to the same foundation.

ONE Risk Advisory specialises in Risk Management and Internal Audit and supports organisations across all three lines, with advice and experienced interim professionals.

About ONE Risk Advisory

ONE Risk Advisory is a specialised firm for Risk Management and Internal Audit that works exclusively with experienced specialists. We specialise in integrated Risk Management across all three lines: from the business in the first line, through compliance and ERM in the second line, to Internal Audit in the third line.

• Advisory: harmonisation of risk methodologies, design of integrated Risk Management models and GRC support (Governance & Control Design and Embedding & Transformation).
• Interim solutions: experienced professionals who temporarily strengthen or build up Risk Management, compliance or Internal Audit (senior specialists on assignment).
• Maturity assessments and baseline measurements: insight into where the organisation stands and what is needed to reach the desired ambition (Risk Management Quality Assessment).

Coming soon: the Risk & Resilience Assessment, an independent assessment of the Risk Management function. We would be pleased to discuss the options for your organisation. Schedule a meeting.

Frequently asked questions