Climber on a rock face, risk under control

Pillar · Risk Management

Risk management that connects to strategy and decisions

Schedule a conversation Our services

Risk management in a dynamic context

From risk identification to decision-making

Strategic choices, operational dependencies, digitalisation and regulation continually introduce new risks and opportunities. Risk management should therefore not be a standalone process, but part of regular decision-making.

Risk management supports boards and management in making well-considered choices, with insight into potential consequences and appropriate control measures.

// 01—Our services

// 01 · Risk Insight

Risk Insight

Identifying the enterprise, process and IT risks that matter most. Enterprise, Process and IT Risk Assessments.

Governance & Control Design

Designing pragmatic governance structures, clear accountability and effective control frameworks. Governance design (three lines), internal control framework design and risk governance models.

Embedding & Transformation

Helping organisations translate frameworks into practical ways of working. Facilitation of implementation, risk workshops, embedding accountability and control framework roll-out.

Optimisation & Assurance Readiness

Strengthening governance and controls through targeted reviews and continuous improvement. Risk Management Quality Assessments, control framework optimisation and benchmarking against leading practices.

// 02—Intake

A good conversation first. Then a proposal.

A first conversation is quickly arranged. You tell us where you stand, we show how we work and what we can do for you. That way you soon discover whether we are a good match.

Schedule a conversation on Risk Management

Frequently asked questions

Which risk management framework fits our risk profile?

For financial institutions: COSO ERM 2017 with a DORA overlay. For industry: ISO 31000 with ISO 27005 for ICT. For the public sector: COSO ERM or ISO 31000, aligned with the organisation's own accountability frameworks. We do not develop our own standards; we apply recognised frameworks proportionally.

What does DORA change for my risk management?

Among other things, DORA sets requirements for ICT risk management, digital operational resilience and strict deadlines for reporting major ICT-related incidents. It also calls for a register of ICT third-party providers and regular testing of digital operational resilience. The regulation has applied to financial entities since 17 January 2025.

What is risk appetite and how does the board define it?

Risk appetite is the amount of risk the board is willing to accept in realising its strategy. We work with six dimensions: strategic, financial, operational, regulatory and compliance, technology and data, and reputational. Per dimension the board defines what is acceptable, tolerable and unacceptable.

How does Risk Management connect to Internal Audit?

Within the IIA Three Lines Model, Risk Management belongs to the second line and Internal Audit to the third. We support both with the same methodology and safeguard their coherence, without compromising the independence of Internal Audit.