Which risk management framework fits our risk profile?

For financial institutions: COSO ERM 2017 with a DORA overlay. For industry: ISO 31000 with ISO 27005 for ICT. For the public sector: COSO ERM or ISO 31000, aligned with the organisation's own accountability frameworks. We do not develop our own standards; we apply recognised frameworks proportionally.

What does DORA change for my risk management?

Among other things, DORA sets requirements for ICT risk management, digital operational resilience and strict deadlines for reporting major ICT-related incidents. It also calls for a register of ICT third-party providers and regular testing of digital operational resilience. The regulation has applied to financial entities since 17 January 2025.

What is risk appetite and how does the board define it?

Risk appetite is the amount of risk the board is willing to accept in realising its strategy. We work with six dimensions: strategic, financial, operational, regulatory and compliance, technology and data, and reputational. Per dimension the board defines what is acceptable, tolerable and unacceptable.

How does Risk Management connect to Internal Audit?

Within the IIA Three Lines Model, Risk Management belongs to the second line and Internal Audit to the third. We support both with the same methodology and safeguard their coherence, without compromising the independence of Internal Audit.

Climber on a rock face, risk under control

Pillar · Risk Management

Risk management that connects to strategy and decisions

Schedule a conversation Our services

Risk management in a dynamic context

From risk identification to decision-making

ONE Risk Advisory supports boards and management with risk management that connects to strategy and decision-making. We work with COSO Enterprise Risk Management (COSO ERM 2017) and ISO 31000 and apply them proportionately to size and risk profile. The services consist of four categories: Risk Insight, Governance & Control Design, Embedding & Transformation and Optimisation & Assurance Readiness. For financial institutions we include the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554, applicable since 17 January 2025).

Strategic choices, operational dependencies, digitalisation and regulation continually introduce new risks and opportunities. Risk management should therefore not be a standalone process, but part of regular decision-making.

Risk management supports boards and management in making well-considered choices, with insight into potential consequences and appropriate control measures.

// 01—Our services

// 01 · Risk Insight

Risk Insight

Risk Insight: ONE Risk Advisory identifies the enterprise, process and IT risks that matter most. We perform Enterprise, Process and IT Risk Assessments and prioritise by impact and likelihood.

Governance & Control Design

Governance & Control Design: ONE Risk Advisory designs pragmatic risk governance based on the Three Lines Model and an internal control framework that fits your organisation, aligned with COBIT 2019 and, where relevant, SOx, DORA, NIS2 and ISAE 3402.

Embedding & Transformation

Embedding & Transformation: ONE Risk Advisory translates frameworks into daily practice, with facilitation of implementation, risk workshops, embedding accountability and a phased roll-out of the control framework.

Optimisation & Assurance Readiness

Optimisation & Assurance Readiness: ONE Risk Advisory strengthens governance and control with Risk Management Quality Assessments, optimisation of the control framework and benchmarking against leading practices, aligned with COSO ERM 2017 and ISO 31000.

// 02—Intake

A good conversation first. Then a proposal.

A first conversation is quickly arranged. You tell us where you stand, we show how we work and what we can do for you. That way you soon discover whether we are a good match.

Schedule a conversation on Risk Management