Risk Management: ISO 31000, MaRisk & DORA Compliance

Risk management consulting helps organizations design, optimize and operate an effective enterprise risk management system — from strategy and framework (e.g. ISO

31000 or COSO ERM) to the day-to-day execution of risk identification, assessment, mitigation and reporting. ADVISORI focuses on regulated industries (banks, insurers, industrial enterprises) with deep specialization in MaRisk, DORA and Basel III/IV for European financial institutions.

Risk management is the systematic process of identifying, assessing, treating, monitoring and reporting risks that could affect an organization’s objectives. The internationally recognized standard is ISO 31000, complemented by COSO ERM in the US and — for European banks — by MaRisk (BaFin), DORA (ICT risk) and Basel III/IV. Risk management addresses strategic, operational, financial, compliance, ESG and reputational risks across the enterprise.

Risk management consulting at ADVISORI typically starts at €25,000–€60,

000 for a focused risk maturity assessment or framework gap analysis, and scales to several hundred thousand euros for a full ERM implementation at a regulated financial institution. Pricing depends on company size, regulatory scope (MaRisk, DORA, Basel III), current risk maturity and depth of IT-system integration. A fixed-price proposal follows a two-hour scoping workshop.

The five steps of risk management under ISO

31000 are: (1) Risk identification — systematically capturing all relevant risks, (2) Risk analysis — assessing probability and impact, (3) Risk evaluation — prioritising against risk appetite, (4) Risk treatment — avoiding, reducing, transferring or accepting, (5) Monitoring & reporting — continuous monitoring and reporting to the board and supervisory body.

ISO

31000 is an international, sector-agnostic risk management guideline — voluntary and non-certifiable, focused on principles, framework and process. COSO ERM (

2017 update: “Integrating with Strategy and Performance”) is a US-originated framework with stronger emphasis on strategy, performance and culture, organized around

5 components and

20 principles. ISO

31000 is broader and lighter; COSO ERM is more prescriptive and dominant in US public companies and SOX environments.

Risk management consulting is most relevant for: (1) regulated financial institutions under MaRisk, DORA or Basel obligations, (2) insurers under Solvency II, (3) listed corporates under IDW PS

981 audit requirements, (4) mid-market firms with complex supply chains or German Supply Chain Act (LkSG) obligations, (5) companies preparing for carve-out, M&A or IPO, (6) ESG-exposed industries with CSRD and climate risk reporting duties.

An effective risk management system consists of several integrated components:

🎯 Governance & Organizational Structure

👥 Risk Strategy & Culture

⚡ Risk Processes & Methods

📊 Risk Technology & Tools

🎓 Risk Competence & Knowledge

Various standards and frameworks are relevant for professional risk management:

📜 ISO 31000• International standard for risk management principles and guidelines

🏢 COSO ERM Framework

🔒 NIST Risk Management Framework

💻 ITIL Risk Management

⚖ ️ Regulatory Frameworks

Systematic risk identification and assessment includes various methods:

🔍 Identification Methods

📊 Qualitative Assessment Methods

📈 Quantitative Assessment Methods

🔄 Risk Aggregation

📱 Technology-Supported Methods

Various strategic options are available for risk control:

🛡 ️ Risk Avoidance

📉 Risk Reduction

🔄 Risk Transfer

✅ Risk Acceptance

🔍 Risk Sharing

Integrating risk management into corporate culture requires a comprehensive approach:

👑 Leadership and Role Modeling

📚 Training and Awareness

🎯 Incentive Systems

📢 Communication

🔄 Process Integration

Various legal requirements for risk management exist in Germany:

⚖ ️ KonTraG (German Corporate Control and Transparency Act)

📊 BilMoG (German Accounting Law Modernization Act)

🔗 Supply Chain Due Diligence Act

🏦 Industry-Specific Regulations

🇪 🇺 EU Regulations

Success measurement in risk management encompasses various dimensions:

📊 Quantitative Metrics

🎯 Process-Oriented Metrics

👥 Cultural Indicators

🔄 Maturity Models

📈 Business Impact

Modern technologies are revolutionizing risk management in various areas:

💻 Risk Management Software

🤖 Artificial Intelligence and Machine Learning

📊 Big Data Analytics

🔗 Blockchain and Distributed Ledger

☁ ️ Cloud-Based Solutions

Risk management varies by industry in focus, methods, and regulation:

🏦 Financial Services

🏭 Manufacturing Industry

🏥 Healthcare

🔌 Energy Supply

💻 Information Technology

Integrating ESG risks (Environmental, Social, Governance) requires a systematic approach:

🌱 Identification of ESG Risks

📊 Assessment Methods

🔄 Integration into Existing Processes

📈 Control Measures

📑 Reporting

An effective risk management plan is created through a structured process:

🎯 Fundamentals and Framework

🔍 Risk Identification and Assessment

🛠 ️ Risk Control Measures

📊 Monitoring and Reporting

🔄 Review and Improvement

Managing cyber risks requires a comprehensive security approach:

🔒 Governance and Strategy

🛡 ️ Technical Protection Measures

👥 Awareness and Training

🔍 Monitoring and Incident Response

🔄 Continuous Improvement

Enterprise Risk Management (ERM) differs from the traditional approach in several dimensions:

🌐 Comprehensive Approach

🎯 Strategic Alignment

👑 Governance and Culture

📊 Risk Quantification

🔄 Continuous Process

Managing supply chain risks requires a multi-dimensional approach:

🔍 Risk Transparency

📊 Risk Assessment

🛡 ️ Risk Mitigation Strategies

📱 Technological Support

🤝 Supplier Management

The integration of risk management into project management encompasses several dimensions:

🎯 Project Initiation

📋 Project Planning

🔄 Project Execution

📊 Project Controlling

📚 Lessons Learned

An effective risk management framework forms the foundation for a sustainable risk culture and enables organizations not only to minimize risks, but also to utilize them as strategic opportunities. Developing such a framework requires a structured yet adaptive approach, tailored to the specific requirements of the organization. Development of a Governance Structure: Establishment of clear responsibilities through the Three-Lines-of-Defense model, with separation between risk-taking, risk control, and independent review Definition of a risk management charter with defined mandates and authorities for bodies such as the risk committee and risk management function Implementation of a flexible reporting system with defined thresholds for different management levels Ensuring regular board involvement in strategic risk decisions Integration of sustainability and ESG risks into the governance structure Development of a Comprehensive Risk Taxonomy: Systematic categorization of all relevant risk types (market, credit, operational, strategic, reputational, and compliance risks) Creation of a hierarchical risk catalog with main and subcategories for granular.

Key Risk Indicators (KRIs) have evolved from simple metrics into a strategic management instrument in modern risk management. As forward-looking measures, they enable organizations to detect potential risks at an early stage before they materialize, allowing for proactive rather than reactive action. The development and implementation of a KRI system requires both subject-matter expertise and a deep understanding of business processes. Strategic Development of KRIs: Derivation of KRIs from the organization's critical risks and strategic objectives Ensuring alignment with risk appetite and risk limits Focus on leading indicators rather than pure loss metrics (lagging indicators) Development of a multi-level KRI hierarchy from operational to strategic indicators Regular review and update of KRIs to ensure continued relevance and effectiveness Technical Design of Effective KRIs: Definition of precise calculation methods with clear data sources and responsibilities Establishment of thresholds with escalation levels (green, yellow, red) based on risk analyses Consideration of trend analyses and rates of change,.

An effective risk assessment program represents the core process of operational risk management and forms the basis for well-informed risk decisions. It extends far beyond point-in-time risk assessments and establishes a continuous, methodologically sound process that combines qualitative and quantitative elements. Implementing such a program requires a well-conceived methodology, clear processes, and the right tools. Methodological Foundations of Risk Assessment: Development of a consistent assessment framework with standardized scales for likelihood and impact severity Integration of multiple perspectives (financial, operational, reputational, strategic, compliance-related) Differentiation between inherent risks (before controls) and residual risks (after controls) Establishment of a risk scoring model with a transparent aggregation logic Consideration of both historical data and forward-looking scenarios Implementation of a Structured Assessment Process: Establishment of an annual calendar with defined cycles for regular risk assessments Conducting bottom-up assessments at the process level and top-down evaluations at the strategic level Organization of cross-functional risk assessment workshops to utilize collective intelligence.

A strong risk management culture forms the foundation of every successful risk management approach and extends far beyond formal processes and structures. It manifests in the day-to-day decisions and behaviors of all employees and shapes how risks are perceived, communicated, and managed. Developing such a culture is a long-term transformation process that requires a strategic approach and continuous attention. Development of a Shared Risk Understanding: Formulation and communication of a clear risk culture vision with explicit expectations Establishment of a uniform risk language and taxonomy throughout the organization Creating a balanced understanding of risks as both threats and opportunities Encouraging open discussion about risk tolerance and risk appetite Development and communication of risk principles as guiding parameters for decision-making Anchoring in Leadership and Organization: Role modeling by leaders through consistent "Tone from the Top" and "Tone from the Middle" Integration of risk management responsibility into all leadership roles Establishment of risk management as an integral.

An effective risk strategy is more than a document

The integration of ESG risks (Environmental, Social, Governance) into risk management is no longer optional for companies, but a strategic necessity. Unlike traditional risks, ESG risks require a shift in horizon and perspective: they are often long-term and systemic in nature, and are associated with considerable uncertainty. The successful integration of these risks requires a comprehensive approach that encompasses both methodological adjustments and an expansion of risk culture. Development of a Comprehensive ESG Risk Understanding: Systematic identification of relevant ESG risks along the entire value chain Conducting a materiality analysis to prioritise ESG factors with the highest business relevance Consideration of both direct ESG risks and indirect risks arising from stakeholder reactions Analysis of the interdependencies between various ESG risk dimensions Development of a forward-looking approach to anticipate long-term ESG trends and risks Methodological Expansion of the Risk Management Toolkit: Adaptation of existing risk assessment methods to adequately capture ESG risks Development of specialised ESG.

An effective risk reporting system goes far beyond standardised reporting and functions as a critical link between operational risk identification and strategic decision-making processes. It transforms complex risk data into actionable information, thereby creating the foundation for well-informed risk management. Developing such a system requires a thoughtful balance between depth of detail and clarity, as well as between retrospective analysis and a forward-looking perspective. Development of a Differentiated Reporting Architecture: Design of a multi-layered reporting model with varying levels of granularity for different target audiences Conception of executive dashboards for top management with focused risk insights and recommendations for action Development of detailed operational risk reports for risk managers and specialist departments Establishment of escalation reporting for critical risk developments Integration of risk reporting into regular management reporting for a comprehensive steering perspective Definition of Meaningful Metrics and Visualisations: Selection of a balanced set of risk metrics (KRIs, limits, trends, risk capital, incidents) Development of.

The management of third-party risks has evolved from a niche topic into a central challenge for modern organisations. With increasing interconnectedness and the outsourcing of business processes, the risk sphere extends significantly beyond a company's own boundaries. Strategic third-party risk management requires a systematic, risk-oriented approach that encompasses both prevention and contingency planning. Development of a Comprehensive Third-Party Risk Taxonomy: Systematic capture of all relevant risk types (operational, financial, legal, reputational, strategic) Consideration of specific compliance risks such as data protection, corruption, sanctions and cybersecurity Capture of ESG risks within the supply chain, including human rights violations and environmental damage Analysis of concentration risks and critical dependencies within the supply chain Consideration of country and geopolitical risks in international business relationships Implementation of a Risk-Based Due Diligence Process: Development of a multi-stage screening process with risk-adjusted levels of scrutiny Establishment of a criticality matrix for the segmentation of third parties by risk potential Use of.

The management of cyber risks has evolved from a purely technical task into a strategic challenge that requires the integration of IT expertise, risk management and company-wide governance. Given the increasing complexity, frequency and potency of cyberattacks, organisations require a comprehensive approach that goes far beyond traditional IT security measures and systematically encompasses all aspects of the business. Development of a Comprehensive Cyber Risk Understanding: Conducting regular cyber risk analyses taking into account business processes, data assets and external dependencies Identification of critical digital assets (crown jewels) and assessment of potential damage scenarios Analysis of threat actors and their motivations, capabilities and typical attack patterns Assessment of the attack surface, including mobile devices, cloud services and IoT components Consideration of emerging risk areas such as artificial intelligence, quantum computing and supply chain attacks Implementation of Multi-Layered Protection Strategies: Development of a defence-in-depth approach with layered security measures and zero trust principles Implementation of preventive controls.

Operational risk management (ORM) has evolved from a regulatory-driven compliance exercise into a strategic value driver that can fundamentally improve the resilience and efficiency of an organisation. A modern ORM programme goes well beyond mere documentation and integrates smoothly into operational processes to proactively identify, assess and manage risks. Successful implementation requires a balance of systematic rigour and pragmatism in order to meet compliance requirements while generating genuine business value. Developing a comprehensive risk taxonomy and methodology: Establishing a differentiated taxonomy of operational risks that encompasses both traditional and emerging risk categories Developing a consistent assessment framework for likelihood, impact and controls Implementing process-based risk assessments that cover the entire value chain Integrating scenario-based analyses for complex, rarely occurring high-risk events Establishing quantitative modelling methods for the monetary valuation of operational risks Integration into business processes and governance: Embedding ORM within the Three Lines Model with clear accountabilities and escalation paths Building a control framework.

Scenario analyses and stress tests have evolved from point-in-time regulatory exercises into strategic instruments of modern risk management. They enable organisations to look beyond the horizon and prepare for extreme events and structural changes that lie outside the scope of historical data. The effective use of these methods requires a structured yet creatively critical approach that combines quantitative rigour with qualitative insight. Developing a differentiated scenario framework: Establishing various scenario types for different purposes (hypothetical, historical and reverse stress tests) Combining top-down scenarios (macroeconomic, geopolitical) with bottom-up scenarios (specific risk drivers) Integrating multi-factor scenarios that account for interdependencies and second-round effects Developing long-term transformation scenarios (e.g. climate change, digitalisation) alongside short-term shock scenarios Balancing plausibility and challenge when calibrating scenario severity Methodical execution and quantitative analysis: Implementing solid modelling approaches with clearly defined assumptions and sensitivity analyses Developing transmission channels for the systematic analysis of impacts across different risk types Applying advanced simulation techniques such.

Business Continuity Management (BCM) has evolved from isolated emergency planning into an integrated component of organisational resilience. In an increasingly interconnected and volatile business environment, developing individual crisis plans is no longer sufficient — organisations require a comprehensive BCM system that ensures the continuity of critical business processes even in the event of severe disruptions. Implementing such a system demands a strategic approach that extends well beyond technical measures. Conducting a comprehensive Business Impact Analysis: Identifying and prioritising critical business processes and their dependencies Determining Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for each critical process Analysing resource dependencies (personnel, IT, infrastructure, suppliers) for each process Assessing financial and non-financial impacts in the event of process disruptions Evaluating seasonality and time-critical periods within the business cycle Developing comprehensive continuity strategies and plans: Formulating differentiated recovery strategies for various disruption scenarios Developing specific plans for different crisis types (IT outage, facility loss, personnel unavailability).

Managing technology risks in an era of rapid digital transformation requires a forward-looking, adaptive approach. Emerging technologies such as AI, blockchain and IoT offer enormous opportunities, but also bring with them complex, often difficult-to-predict risks. Integrating these technologies into existing business models and processes demands a strategic approach that keeps both innovation and risk control firmly in view. Developing a systematic Technology Risk Assessment: Implementing a structured assessment process for new technologies prior to their introduction Conducting multi-dimensional risk analyses that consider functional, operational, regulatory and ethical aspects Establishing continuous technology scanning processes for the early identification of relevant innovations and their risk potential Building specific assessment frameworks for different technology types (e.g. data-driven technologies, automated decision systems, cloud services) Integrating forward-looking scenario analyses to anticipate long-term technology risks Implementing a risk-based technology adoption approach: Developing a phased adoption approach with controlled pilot phases and defined Go/No-Go criteria Establishing a Technology Governance Framework with clear.

The digitalisation of risk management represents a impactful opportunity for organisations that extends well beyond efficiency gains. A well-considered digitalisation approach can fundamentally improve the quality, speed and strategic relevance of risk management. This is not merely about implementing individual tools, but about creating an integrated digital risk ecosystem that connects traditional risk approaches with modern technologies. Developing a comprehensive risk data architecture: Building a centralised risk data platform with uniform data standards and taxonomies Integrating diverse data sources from internal systems (ERP, CRM, HR) and external sources (market data, economic indicators, social media) Implementing a data quality management strategy with automated validation and cleansing routines Creating a flexible data architecture capable of processing both structured and unstructured data Developing a central risk data model with clearly defined relationships between risks, processes, controls and organisational units Implementing advanced analytics technologies: Introducing predictive analytics for early risk detection through pattern recognition and anomaly detection Leveraging machine.

Reputation risk management has evolved from a reactive approach into a strategic core function in an interconnected, transparent world. A company's reputation is today a central value creation factor and, at the same time, highly susceptible to rapid change. Unlike traditional risk categories, managing reputation risks requires an integrated approach that crosses departmental boundaries and is closely aligned with corporate strategy and culture. Developing a systematic reputation risk framework: Implementing a comprehensive approach that treats reputation risks both as a standalone risk category and as a consequence of other risks Developing specific indicators to measure and monitor corporate reputation among various stakeholder groups Conducting regular reputation risk assessments with a focus on key topics such as ESG, product safety, data protection, and ethical conduct Identifying reputation drivers and levers through stakeholder mapping and materiality analyses Establishing a cross-media monitoring system for the early detection of reputation risks Building proactive reputation management capabilities: Developing a strategic.

Model Risk Management (MRM) has evolved from a bank-specific niche topic into a critical component of risk management across numerous industries. With the growing proliferation of complex quantitative models for decision-making processes — from credit scoring and pricing models to algorithmic trading systems and AI applications — the associated risks are also increasing significantly. A solid MRM framework enables companies to harness the benefits of advanced modelling while effectively managing the risks involved. Developing a comprehensive model risk framework: Establishing a company-wide definition of models and model risks with clear delineation from other tools and systems Implementing a risk-based model classification with differentiated control and governance requirements Developing a model inventory with comprehensive documentation of all relevant models within the organisation Building a systematic model lifecycle management process from development through to decommissioning Integrating model risk aspects into enterprise-wide risk management and risk reporting Implementing solid validation processes: Establishing independent model validation functions with the.

Supply chain risk management has become a strategic priority for companies across all industries. In a globalised, interconnected economy with increasingly complex supply networks, it is no longer sufficient to consider only direct supplier relationships. Rather, effective Supply Chain Risk Management (SCRM) requires a comprehensive, multi-tiered approach that creates transparency, reduces dependencies, and builds resilience. Developing a comprehensive supply chain risk framework: Implementing a systematic methodology for identifying and assessing supply chain risks that encompasses both direct and indirect risks Categorising risks into various types: operational, financial, geopolitical, environmental, regulatory, and reputational Capturing dependencies and single points of failure across the entire supply chain Quantifying the potential impact of supply disruptions on business processes, finances, and reputation Integrating ESG risk factors into supply chain risk management (labour conditions, environmental impact, governance practices) Building transparency and monitoring capabilities: Developing multi-tier supplier mapping that extends beyond Tier-1 suppliers (n-tier visibility) Implementing digital tracking technologies such as blockchain.

Financial risk management has evolved from a purely defensive discipline into a strategic value driver that makes a significant contribution to a company's stability and competitiveness. In an environment of increasing market volatility, complex financial instruments, and more stringent regulatory requirements, systematic, integrated management of financial risks is essential. Implementing effective financial risk management requires a structured approach that encompasses both quantitative methods and qualitative assessments. Developing a comprehensive financial risk framework: Establishing an integrated framework that covers all relevant financial risk categories: market, credit, liquidity, interest rate, and currency risks Implementing a risk-based classification with differentiated management approaches for various risk types Building a portfolio approach to account for risk diversification and correlations Integrating stress testing and scenario analyses to assess extreme yet plausible market movements Developing an Enterprise Risk Management approach that links financial risks with other corporate risks Implementing advanced risk measurement and modelling methods: Employing statistical models such as Value-at-Risk (VaR),.

Compliance risk management has evolved from a purely reactive control function into a proactive, value-adding component of corporate governance. In an environment of increasing regulatory complexity, cross-border business activities, and severe sanctions for violations, systematic management of compliance risks is essential for sustained corporate success. Effective compliance risk management goes far beyond mere adherence to regulations and integrates compliance aspects into business strategy and corporate culture. Developing an integrated compliance risk framework: Establishing a comprehensive compliance universe covering all relevant areas of law, regulations, and standards Implementing a risk-based prioritisation with a focus on high-risk areas such as anti-corruption, data protection, competition law, and anti-money laundering Conducting regular compliance risk assessments with a standardised methodology and clear evaluation criteria Developing a dynamic compliance monitoring system with Key Compliance Indicators (KCIs) and early warning indicators Integrating compliance risks into enterprise-wide risk management and strategic planning Implementing solid compliance programmes and controls: Developing precise, practice-oriented compliance policies.

Climate-related risks have evolved from a niche topic to a central element of modern risk management. Given the increasing physical impacts of climate change, regulatory developments, and shifting stakeholder expectations, companies must implement a systematic approach to managing climate-related risks and opportunities. This requires both integration into existing risk management structures and specific methods and governance mechanisms that account for the uniqueness of this risk category. Developing a comprehensive climate risk framework: Systematic identification and categorisation of climate-related risks into physical risks (acute and chronic) and transition risks (regulatory, technological, market-related, reputational) Conducting detailed climate risk analyses across various time horizons (short-, medium-, and long-term) Integration of climate scenarios based on scientifically grounded pathways (e.g. IPCC scenarios, Network for Greening the Financial System) Establishing climate-related risk appetite statements and tolerance thresholds Linking climate risks to other risk categories such as operational, financial, and strategic risks Implementing advanced assessment and modelling methods: Developing quantitative models to.