What can controllers and internal auditors do to support risk ownership?

Abstract

Over the years, many organisations adopted several types of Three Lines models for optimising risk management coordination and control. According to these models, first line risk ownership is required for routinely applying risk management in all of the organisation’s activities, which seems highly underdeveloped. From an exploratory and development research, which builds on conventional risk management approaches, three pragmatic suggestions are derived: (1) simplifying risk management by asking three specific OUD-questions about Objectives, Uncertainties and what to Do, (2) clarification of objectives at all organisational levels, and (3) connecting responsibility for objectives to risk responsibility. Routinely applying these suggestions by second line controllers and third line internal auditors may support first line risk ownership.