Risk Management Statement (VOR).

Risk Management Statement (VOR): what you need to know

Rules about risk management and its accountability (governance) is a concept that has been around in the business world for a long time. It all started with Peters' governance code in 1997, which first introduced risk management. Since then, risk management has been increasingly concretized in the Dutch corporate governance code and the scope has broadened to include operational, sustainability, IT and privacy risks, among others.

In December 2023, the Statement on Risk Management (VOR) was added to the corporate governance code for companies. This statement requires directors and their companies to take greater responsibility for financial and social risks. The board must conduct a risk analysis and establish risk appetite.

VOR and CSRD: Challenges and solutions for risk management

Preparations for the VOR have many parallels with preparations for the Corporate Sustainability Reporting Directive (CSRD). Both require risk analysis and transparency in reporting. Like the VOR, the CSRD requires organizations to provide detailed information about their risks and control measures. In addition, it often requires reporting on non-financial information where systems are not yet in place to do so.

One of the biggest challenges in implementing both VOR and CSRD is data availability. Organizations must collect and analyze extensive data to meet reporting requirements. This requires significant investments in technology and staff capacity. The perspective of an independent expert is crucial in this regard.

The role of the internal auditor is important in this process. They are responsible for assessing the effectiveness of risk management and data-generating systems within the organization. Internal auditors play an important role in identifying and assessing risks, and recommending appropriate control measures. They can perform an early assessment, even before the external auditor starts their review, and provide an "early warning" signal. Internal Audit's findings provide a good basis for growing to a stable situation in a controlled manner.

The role of risk management is also crucial. Risk managers are responsible for developing and implementing risk management strategies and processes. They work closely with various departments to identify, evaluate and mitigate risks. Risk managers oversee the implementation of mitigating measures and help the board account for the design and effective implementation of internal risk controls and systems.

How ARC People can help organizations (prepare for) the VOR

The VOR is therefore an important requirement that obliges companies to identify risks and determine control measures, and to be transparent about these towards stakeholders. ARC People can support organizations in various ways in (preparing for) the preparation of the Risk Management Declaration (VOR).

• Risk analysis and risk appetite: ARC People can assist in conducting a thorough risk analysis and facilitate in determining the organization's risk appetite. This is a crucial step in the process because it allows the board to understand the key risks and determine the extent to which these risks are acceptable. For non-acceptable risks, ARC can help formulate control measures and guide their implementation.
• Assessment of risk management: ARC People's professionals can assess the effectiveness of risk management and control systems within the organization. We can help identify and assess risks, and advise on appropriate control measures.
• Implementation and monitoring: Because we not only assess but are also content specialists in the field of implementing measures, ARC People's professionals can also support actual risk mitigation, and oversee it (monitoring).
• Transparency and accountability: ARC People can support organizations in ensuring transparency and accountability. This is an important aspect of the VOR, as companies are required to disclose the risks identified and the control measures taken. An independent review (internal audit) or assessment can help flesh out this transparency.
• Strategic decision-making: Professionals from ARC People can also be involved in strategic decision-making. Our understanding of risks and control measures is of great value to the board and can assist in making informed decisions. Our senior professionals often operate at the board level and are uniquely qualified to advise directors on risk management and reporting.
• Culture of risk awareness: Last but not least, ARC People can help promote a culture of risk awareness within the organization. This includes organizing training sessions and workshops. This is essential for effective risk management and helps create an environment where risks are identified and addressed in a timely manner.