Risk Analysis and Risk Management in Germany

Nevertheless, it is imperative, not only for its implementation but also for the assessment of how great the entrepreneurial risk tolerance could be, that companies detect their own risk potentials with the help of a risk analysis (so-called compliance risk assessment) and to be explicitly familiar with this. The analysis of opportunities and risks is a core component of economic planning processes. In this context, it is crucial to be aware of the interdependencies between opportunities and risks at an early stage and thereby be able to incorporate them into the decision-making process in a structured manner. Moreover, individual risk factors interact with each other.

From a German legal perspective, the compliance risk assessment also has a liability-reducing component: Effective risk identification is always a sign that the company’s management is adequately fulfilling its supervisory duties. This can, as a component of functioning CMS structures, sustainably avoid or at least reduce liability risks in companies and for executives (personally) and thereby contribute to the successful continuation of the company. This liability-relevant aspect not least emphasizes the necessity of carrying out a compliance risk assessment.

The systematic and integrated

• collection,
• analysis,
• evaluation and
• control

of compliance risks carried out as part of the compliance risk assessment can be regarded as a basic prerequisite for the implementation and optimization of an effective Compliance Management System (CMS). In this respect, the compliance risk assessment is at the heart of every CMS.

An effective CMS that dynamically adapts to company- and industry-specific risks thus also includes a detailed compliance risk assessment that is specifically tailored to the company. Only with the help of a system that is intrinsically sound can any threatening 

• compliance violations,
• breaches of duty and
• instances of negligence

be identified at an early stage and countered with appropriate measures in order to be able to avert civil and criminal liability risks, together with the associated high fines and reputational damage, for the company and its managers, supervisory bodies and senior executives.

A compliance risk assessment basically consists of five successive phases and establishes a continuous cycle: Starting with (1) risk identification and (2) risk prioritization and risk assessment, this leads to (3) risk management followed by (4) risk monitoring and (5) risk reporting as the final step of the process.

• Risk identification
  In the first phase of the compliance risk assessment, the (1) risk identification, all potential compliance risks within the company are identified. The aim here is to compile all probable risks as a whole - for example, in the context of a risk workshop, starting with the management or key process and risk owners.
• Risk prioritization
  In order to enable a subsequent detailed individual analysis of the most important compliance risks for the respective company, a pre-selection can be made within the framework of (2) risk prioritization and assessment, according to, for example, relevance, organizational unit or type of offence. The identified compliance risks can then be assessed based on their probability of occurrence and damage potential.
• Risk management
  On the basis of the information on potential compliance risks within the company obtained from the two previous phases of the compliance risk assessment, (3) risk management can now be carried out. In the course of this process step, management strategies and preventive measures are explored. These can be geared towards risk avoidance, risk reduction, risk limitation or risk transfer depending on the type and severity of risk specific to the company and industry.
• Risk monitoring
  The next phase of the compliance risk assessment, the (4) risk monitoring, serves to monitor changes in the compliance risks present in the company. In addition, the effectiveness of implemented management strategies and preventive measures is recorded, taking into account this continuously changing risk situation.
• Risk reporting
  Finally, (5) risk reporting, the last phase of the compliance risk assessment, comprises the communication of the information obtained regarding the compliance risk potentials within the company to the company management and the relevant departments and interested parties. However, before the compliance risk assessment is carried out, the process should first and foremost be embedded in the company as part of the allocation of responsibilities. By assigning responsibilities, assembling an interdisciplinary project team and providing appropriate resources, an effective compliance risk management process can be established. Furthermore, integration into operational planning also plays a significant role in the successful implementation of a compliance risk assessment. In particular, a correlation should be established with traditional corporate risk management; the definition and assessment of the significant compliance risks affecting the company should be carried out in this context and in a phase consistent with the corporate strategy and values.

We support you in identifying risks and averting the resulting negative effects on your company, your reputation and your personal liability risks through (preventive) measures. By means of company-related measures such as

• the identification of the risk potential of the individual company,
• reacting to current events and assessing any risks,
• preventive advice on industry-specific risk areas,
• the design, implementation and execution of a risk assessment system,
• the integration into existing compliance management structures,
• the establishment and implementation of necessary compliance management structures,
• the establishment of appropriate whistleblower systems to identify and minimize risks and
• the implementation of all steps and measures in risk analysis (preventive as well as event-related),

violations of laws and regulations can be systematically and manageably countered in acute cases.

For this purpose, we evaluate the status quo of your implemented Compliance Management System, both as an overall concept or in the context of selected components, in order to integrate measures that are specifically tailored to meet the needs of your company.