Given the research question, the literature research aims to explore the presence of first line risk ownership in organisations and its support by second and third line professionals. The scientific literature search has been executed in databases of Scopus and Web of Science. The search was restricted to papers in English and published within the period 2008–2021, thus including the start of financial crisis which raised extra attention to risk management. Additional inclusion criteria were articles and conference papers in the subject areas of business, management, and accounting. Search terms were ”three lines of defence model” OR “three lines model” AND “risk management” (with respectively 7 and 5 hits), ”risk ownership” OR “risk responsibility” OR “risk accountability” (with respectively 25 and 10 hits), and “risk ownership” OR “risk management roles” (with respectively 14 and 8 hits). All abstracts of the retrieved papers have been reviewed with regard to useful information about first line risk ownership and second and third line support. Additional searches in the databases Springer Link, Taylor and Francis and Science Direct with the same search terms and criteria did not provide additional useful information. In total eight useful papers were selected from the entire literature search, which confirms the conclusion of Bantleon et al. (2021) that research on the implementation of the Three Lines of Defence model and its challenges is scarce. Table 1 shows the main findings on the presence of first line risk ownership and how second and third line professionals may support this presence.

From Table 1 it follows that the presence of risk ownership in the first line is not mentioned explicitly in the scientific literature. However, signals for lacking first line risk ownership do emerge, such as fuzziness between first line and second line roles (Eulerich 2021; Davies and Zhivitskaya 2018; Mabwe et al. 2017). Furthermore, the importance of first line risk ownership arises from several points of view. Ittner and Oyon (2020) conclude from a finance function perspective that having more risk owners, in addition to the CFO, is associated to a higher degree of ERM sophistication. From a technological point of view, Tammenga (2020) acknowledges that risk ownership is needed for effectively dealing with technological developments in risk management, such as artificial intelligence and machine learning. Årstad and Engen (2018) highlight the utmost importance of risk ownership from a safety point of view. They conclude that major accidents may be viewed as failures of risk ownership. Furthermore, from a quality perspective, Luburic et al. (2015) merge quality management with risk management in the Three Lines model, which implies that process owners automatically become risk owners.

As the presence of risk ownership is not explicitly mentioned in Table 1, it follows logically that the selected literature does not explicitly - or not at all – indicate ways to support first line risk ownership by second and third line professionals. According to Årstad and Engen (2018, p. 64), “Many practices are not familiar with the notion of risk ownership.” Therefore, they propose ten conditions for developing risk ownership, starting with acceptance of risk ownership. This implies that “any claim to not be a risk owner must be defined as dysfunctional” and that “risk ownership follows from the responsibility and authority delegated to individuals and entities in any system” (Årstad and Engen 2018, p. 61). This seems to align with Ittner and Oyon (2020), who associate broader risk ownership with a greater influence on ERM adoption.

Some suggestions that may contribute to enhance first line risk ownership may be derived from the literature research results. These are providing a well-defined risk appetite and giving attention to the type of relationship between first and second line professionals (Davies and Zhivitskaya 2018). Mabwe et al. (2017) and Luburic et al. (2015) suggest providing risk management training of first line employees. By only one sentence, Davies and Zhivitskaya (2018 p. 41) seem to summarise Table 1: “While the [Three Lines] concept has theoretical attractions, it also has the potential to diffuse responsibilities for risk in a way which could reduce accountability rather than enhance it.” This fuzziness in responsibilities will not be reduced by the fact that the recent Three Lines model allows combining first and second line roles (Eulerich 2021). Perhaps, this will even move more organisations to add a centralized risk function to the three lines, as indicated by Mabwe et al. (2017), which demonstrates a lack of confidence in three lines approaches for coordinating and controlling risk management.

In conclusion, the literature research implicitly suggests that attention to risk ownership is primarily lacking in the first line of organisations. It also gives evidence for the importance of broad risk ownership in organisations from several points of view. Furthermore, the selected literature provides some general suggestions for second and third line professionals to support first line risk ownership.

Following the literature research, some empirical data from the Dutch practice has been explored. While this data is also limited, it may give at least some empirical evidence about the presence of first line risk ownership, as well as suggestions for second and third line support. The empirical data set consists of six research reports, which are provided by experienced second and third line professionals in a variety of sectors. All of them executed their research as part of a post-graduate risk management masterclass at a Dutch university. The research objective was to evaluate the application of well-structured risk management in the organisations of the professionals. Selection criteria for the reports were the second or third lines functions of the researchers and their report ratings (8.2 on average, ranging from 7 to 9 on a scale of 1 to 10). The research projects were executed in-company in the period 2015–2020 in Dutch public and private organisations. Table 2 summarises the main empirical research findings, including a remarkable quote for each case.

Table 2 indicates that the main research findings within all the six organisations are similar: risk management is not yet completely implemented in these organisations and risk ownership is generally lacking, as well as second and third line support. The empirical data seems to confirm that risk management should be fully integrated in the first line activities, which requires first line risk ownership and second and third line support. In conclusion, the empirical research in six Dutch organisations in several sectors confirms that risk ownership is both needed and lacking in the first line of the case organisations. It also corroborates the importance of first line risk ownership and second and third line support for realising this ownership.

The exploratory research provides limited, yet valuable data from the scientific literature and the Dutch practice. The results from the literature research (Table 1) align largely with the empirical results (Table 2): Risk ownership seems widely lacking in the first line of organisations, despite or perhaps even because of the presence of second and third line roles. Nevertheless, the importance of risk ownership for realising fully integrated risk management seems to be confirmed, as well as the need for second and third line support for developing such ownership.

After extensive and rigorous research on the implementation of risk management, Van Staveren (2009, p. 375) concluded: “Managing risk is difficult. Applying risk management is more difficult. Implementing risk management in organisations is the most difficult.” When it comes to developing a routine for risk management, “failure is more the rule than success” (Van Staveren 2009, p. 376). This statement seems to be confirmed by the exploratory research results. While advocating the need for first line risk management and ownership, conventional risk management guidance by widely applied frameworks such as COSO (2017) and ISO (2018) seems insufficient to realise first line risk management and ownership. For this reason, their conventional risk management approaches are critically evaluated in the next section.

In a multi-disciplinary development research, Van Staveren (2009) combined proven theories from risk management, innovation management, and change management, which resulted in eighteen key conditions for risk management methodologies. Presence of these key conditions supports the routine application of risk management. By considering the exploratory research results, three key conditions seem particularly promising for developing first line risk ownership by second and third line support: (1) risk management methodologies should become easily to apply within existing practices, (2) these methodologies should fulfil the needs of its first line users, and (3) responsibilities for managing risk should be clear. This latter key condition can be interpreted as realising risk ownership. Similar key conditions, also indicated as critical success factors, are for instance derived by Arena et al. (2010), Paté-Cornell and Cox (2014), and Oliveira et al. (2019). Therefore, by recalling the research question, how can second and third line professionals provide support in creating these key conditions in the first line of organisations, by building on existing risk management approaches of COSO (2017), ISO (2018) and IIA (2020)?

For realising the first key condition - making risk management easy to apply within existing practices - it is suggested to summarise the conventional risk management steps, as provided by COSO (2017), ISO (2018) and supported in the scientific literature (e.g. Aven 2020), via six generic risk management steps into three generic questions. This generalisation and simplification are presented in Table 3.

Regarding the first question in the right column of Table 3, examples of objectives are strategic objectives, operational objectives, as well as program, project, and team objectives. Realising objectives aims to create and to protect value, the ultimate purpose of risk management. Regarding the second question, uncertainties that negatively affect one or more objectives can be considered as risks. Uncertainties with a positive impact are opportunities. Regarding the third question, options for doing, i.e. selecting and taking appropriate measures, are for example the 4T options: Tolerate, Treat, Transfer or Terminate (Hopkin 2017).

Given the first letters of objectives, uncertainties and doing, the three questions will be easy to remember as OUD-questions. Second and third line professionals may train and support first line managers and professionals by explicitly asking the three OUD-questions as a routine, for instance during regular meetings. Moreover, these OUD-questions can be explicitly answered in regular first, second or third line progress, performance, or management reports. In this way, an easily accessible and applicable risk management approach becomes embedded in daily working practices. Obviously, after answering the OUD-questions serious risks may need a more in-depth analysis by taking the conventional risk management steps, as presented in Table 3. The awareness and urgency for this deeper analysis will become paramount by the OUD-answers.

For realising the second key condition - risk management fulfils the need of its first line users - objectives should become leading. According to the definition of ISO (2018, p. 1): “risk is the effect of uncertainty on objectives.” COSO (2017) provides a similar risk definition. Thus, by definition each risk should be derived from an objective. In each and every organisation first line managers and professionals at all organisational levels need clear objectives to do their work effectively and efficiently. Furthermore, in today’s complex and dynamic organisational environments, managers and professionals will encounter a lot of uncertainties, either risks or opportunities, on their way to realising objectives. Hence, any dedicated first line employee or manager should become highly motivated to become aware of their objective-effecting uncertainties, risk, and opportunities. After all, only then they will be driven to take appropriate and timely risk and opportunity measures. Obviously, as part of their roles, second and third line professionals should help the first line to clarify their objectives.

Development of the third key condition of clear risk responsibilities by risk ownership follows logically from the previous two key conditions, as well as from the mentioned ISO (2018) risk definition. Therefore, first line responsibility for objectives should also imply first line responsibility for effectively and efficiently dealing with any objectives-related uncertainties: risks and opportunities. Again, second and third line professionals should assist first line employees with clarifying these risk responsibilities and acting accordingly in their day-to-day activities.