Risk Management Statement (VOR)
The management board's statement in the management report on the internal risk management and control systems, in best practice provision 1.4.3 of the Dutch Corporate Governance Code 2025. It applies to financial years from 1 January 2025, on a comply-or-explain basis, and extends the earlier in control statement to sustainability reporting and operational and compliance risks.
Source: Nederlandse Corporate Governance Code 2025, best practice bepaling 1.4.3; Besluit inhoud bestuursverslag (Stb. 2026, 15); Practice Guide VOR en de Internal Auditfunctie (IIA Nederland, 2024); Internal Audit Monitor 2025
With the Risk Management Statement (Verklaring omtrent Risicobeheersing, VOR), the management board of a listed company accounts for the internal risk management and control systems. The statement is set out in best practice provision 1.4.3 of the Corporate Governance Code 2025 and applies to financial years from 1 January 2025: the first statements appear in the management reports on 2025, published in 2026. Since 3 February 2026 the Code has been designated by law through the Decree on the contents of the management report. Like the whole Code, the statement is subject to comply or explain.
With clear substantiation, the board states that the report provides sufficient insight into shortcomings in the operation of the systems; that the systems provide a reasonable degree of certainty that the financial reporting is free of material misstatement; that they provide at least a limited degree of certainty that the sustainability reporting is free of material misstatement; what degree of certainty they provide that operational and compliance risks are managed effectively; that it is justified that the financial reporting has been prepared on a going concern basis; and that the material risks and uncertainties for the next twelve months have been disclosed. Only for operational and compliance risks do the explanatory notes state that certainty should not be read as the accounting term assurance.
The external auditor does not provide assurance on the statement. The auditor checks whether the statement is consistent with the financial statements and free of material misstatement; at the request of the supervisory board, additional work on specific areas is possible.
The Code assigns the internal audit function no specific task for the VOR. According to the Practice Guide on the VOR and the internal audit function published by IIA Netherlands (November 2024), the role of internal audit in governance does not change, but its work does: audits of risk areas and of risk management, an assessment of the quality of the second line, a review of the draft statement and advice on its substantiation. In the survey of the Internal Audit Monitor 2025, 85% of the 34 functions were involved in the VOR, and 21% provided formal assurance on (parts of) the statement.
ONE Risk Advisory helps boards substantiate the statement, from risk assessment and control framework to the role of the second and third lines, and supports audit functions in their contribution to the VOR.
Last updated:
Related service Governance & Control Design
Frequently asked questions
Is the VOR mandatory?
The VOR is part of the Corporate Governance Code and is subject to comply or explain. What is required by law is accounting in the management report for the application of the Code; a company that does not issue the statement, or issues it differently, explains why.
Does the external auditor provide assurance on the VOR?
No. The external auditor checks whether the statement is consistent with the financial statements and free of material misstatement. An additional engagement on specific parts is possible at the request of the supervisory board.
What role does internal audit play in the VOR?
According to the Practice Guide of IIA Netherlands, internal audit contributes through audits of risk areas and of risk management, an assessment of the second line, a review of the draft statement and advice on its substantiation. In the Internal Audit Monitor 2025, 85% of the 34 functions in the survey were involved in the VOR.