Risk Analysis and Risk Management in Germany

Company employees, in particular members of the management, make numerous significant decisions in their (professional) daily routine which can often be a balancing act between risk-taking and (personal) liability risk. To sustainably avoid liability risks at both company and board level, the implementation and maintenance of a compliance management system is therefore necessary.

Nevertheless, it is imperative, not only for its implementation but also for the assessment of how great the entrepreneurial risk tolerance could be, that companies detect their own risk potentials with the help of a risk analysis (so-called compliance risk assessment) and to be explicitly familiar with this. The analysis of opportunities and risks is a core component of economic planning processes. In this context, it is crucial to be aware of the interdependencies between opportunities and risks at an early stage and thereby be able to incorporate them into the decision-making process in a structured manner. Moreover, individual risk factors interact with each other.

• Risk management
  On the basis of the information on potential compliance risks within the company obtained from the two previous phases of the compliance risk assessment, (3) risk management can now be carried out. In the course of this process step, management strategies and preventive measures are explored. These can be geared towards risk avoidance, risk reduction, risk limitation or risk transfer depending on the type and severity of risk specific to the company and industry.
   
• Risk monitoring
  The next phase of the compliance risk assessment, the (4) risk monitoring, serves to monitor changes in the compliance risks present in the company. In addition, the effectiveness of implemented management strategies and preventive measures is recorded, taking into account this continuously changing risk situation.
   
• Risk reporting
  Finally, (5) risk reporting, the last phase of the compliance risk assessment, comprises the communication of the information obtained regarding the compliance risk potentials within the company to the company management and the relevant departments and interested parties. However, before the compliance risk assessment is carried out, the process should first and foremost be embedded in the company as part of the allocation of responsibilities. By assigning responsibilities, assembling an interdisciplinary project team and providing appropriate resources, an effective compliance risk management process can be established. Furthermore, integration into operational planning also plays a significant role in the successful implementation of a compliance risk assessment. In particular, a correlation should be established with traditional corporate risk management; the definition and assessment of the significant compliance risks affecting the company should be carried out in this context and in a phase consistent with the corporate strategy and values.