Over the years, many organisations adopted several types of Three Lines models for optimising risk management coordination and control. According to these models, first line risk ownership is required for routinely applying risk management in all of the organisation’s activities, which seems highly underdeveloped. From an exploratory and development research, which builds on conventional risk management approaches, three pragmatic suggestions are derived: (1) simplifying risk management by asking three specific OUD-questions about Objectives, Uncertainties and what to Do, (2) clarification of objectives at all organisational levels, and (3) connecting responsibility for objectives to risk responsibility. Routinely applying these suggestions by second line controllers and third line internal auditors may support first line risk ownership.

Risk management, risk ownership, three lines of defence model

It is widely agreed that professional risk management may help to realise the objectives of public organisations and companies. Nevertheless, many first line managers and professionals consider risk management still as a ‘ritual dance’ or ‘paper tiger’. This article provides easy-to-apply suggestions which may reduce this practical problem.

The ultimate purpose of risk management in organisations is to create and to protect value, despite the occurrence of uncertainties and risks in all sorts of organisational processes and activities. Value differs and may include cost control, just-in-time delivery, sustainability, safety, quality, and reputation. This risk management purpose is widely supported from a scientific risk management view (e.g. SRA 2015; Aven 2020) and from a practitioner’s view (e.g. COSO 2017; ISO 2018; IIA 2020). Moreover, in the Netherlands and many other countries, risk management is required by laws, regulations, and governance codes.

For optimising risk management coordination and control, many public organisations and companies adopted the Three Lines of Defence model (IIA 2013), the similar Three Lines of Accountability approach (COSO 2017), or recently the Three Lines model (IIA 2020). In all these models, three lines represent different types of risk management roles and activities. According to Institute of Internal Auditors (IIA 2020, p. 3), “First line roles are most directly aligned with the delivery of products and/or services to clients of the organisation, and include the roles of support functions.” An example of support within the first line is the ‘back office’. First line managers and professionals should therefore execute risk management within their processes and activities. Second line professionals such as business controllers should support first line risk management. Third line professionals of internal audit have to ensure independently the quality of the first and second line risk management activities. They report to management and the governing body and provide advice for continuous improvement. Thus, in theory, risk management seems well-established by the three lines approach.

However, the current Three Lines model and its predecessors are not without debate. In earlier editions of this journal, scholars and practitioners discussed the model’s advantages and disadvantages. For instance, Roos Lindgreen and Daams (2020) refer to Chambers (2018) and Davies and Zhivitskaya (2018). These scholars criticise the ambiguity of risk management roles and responsibilities, which might reduce risk management ownership in the first line. Nevertheless, Roos Lindgreen and Daams (2020) propose to retain the Three Lines model, while adapting it to the requirements of organisations. Other researchers are less generous. Paape (2013) concluded failure of Three Lines model, by recalling the Libor-scandal in the banking sector where the model is well-established. Non-performance of first line risk management could not be prevented by the second and third lines. Shortly after the financial crisis of 2008–2009, Power (2009, p. 849) even stated that “the security provided by ERM [Enterprise Risk Management] is at best limited to certain states of the world and at worst it is illusory – the risk management of nothing.” Hence, standard risk management approaches need to be challenged (Huber and Scheytt 2013). While academic research on risk management is still in its infancy (Bromiley et al. 2014), Mikes and Kaplan (2015) conclude that risk management approaches are largely unproven. The implementation and value of ERM frameworks were further investigated, for instance by Gatzert and Martin (2015) and Hoyt and Liebenberg (2015). But for example managing organisational risk, i.e. risks that organizations cause through their management, operational, or maintenance deficiencies, remains ’muddling through’ (Gould 2021).

Nevertheless, despite the drawbacks of the Three Lines model and ongoing risk management challenges, concern controllers, business controllers, and financial controllers of the second line, as well as third line internal auditors do need reliable risk data. For instance, controllers require risk information for judging investment proposals. Internal auditors require risk management process information for judging the organisation’s risk management quality. Therefore, being able to fulfil second and third line roles depend highly on first line risk management application, and therefore on first line risk ownership.

International standards and guidelines are noticeably clear about the relevance of first line risk ownership. The widely recognised and applied enterprise risk management guideline of the Committee of Sponsoring Organisations of the Treadway Commission (COSO) advocates the need for full integration of risk management within the organisation’s activities and processes – that is in the first line – and thus the need for risk ownership: “Everyone is a risk manager” (COSO 2017, p. 18). While organisations are free to separate or blend their first and second line roles, the Institute of Internal Auditors (IIA 2020, p. 3) is also crystal clear about risk ownership: “However, responsibility for managing risk remains a part of first line roles and within the scope of management.” The ISO 31000 guideline on risk management of the International Organisation for Standardization (ISO 2018, p. 7) put it as follows: “Top management […] should emphasize that risk management is a core responsibility.” Therefore, top management should identify risk owners, which are defined as “individuals who have the accountability and authority to manage risk”. From the relevance of first line risk ownership in the Three Lines model, as well as in the international risk management guidelines and standards, the following research question emerges: what can controllers and internal auditors do to support first line managers and professionals to take true risk ownership and therefore to make risk management as a normal routine of their activities? In order to draw a generic applicable answer to this question a concise qualitative research has been performed. This started with designing a suitable research approach (Section 2), which resulted in an exploratory research (Section 3), and a development research (Section 4). Finally, the research outcome is discussed, including the research quality. The resulting conclusion provides an answer to the research question (Section 5).

Based on the problem description and resulting research question in the introduction, a two-step research approach has been selected. The object of research is risk ownership as prerequisite for routinely applying risk management in the first line of organisations. In this paper risk ownership is considered synonym to risk responsibility and risk accountability, by following the mentioned ISO (2018) definition: having the accountability and authority to manage risk.

The first step is an exploratory research (Section 3), which involves a focused literature research and a concise empirical research. The literature research aims to explore the presence of first line risk ownership in organisations. Ideally, the literature research also reveals how second line controllers and third lines internal auditors may support first line risk ownership. The empirical research aims to confirm or contradict the literature research results with experiences from six Dutch organisations.

The second research step involves some development type of research (Section 4). This research step builds on a multi-disciplinary development research by Van Staveren (2009) and combines theories from risk management, innovation management, and change management. Van Staveren (2009) provided key conditions for implementation risk management methods. Some of these will be selected in order to enhance first line risk ownership.

Section 5 provides a brief discussion of the research process and results, including remarks on quality criteria such as validity and reliability. The resulting main conclusion provides a provisional answer to the research question.

This final section provides a brief discussion of the research process and outcome, including an appraisal of its quality. The discussion results in the main conclusion, which can be seen as a generic applicable yet provisional answer to the research question.

The exploratory research provided limited but valuable data from the scientific literature and the Dutch practice. The results indicate that first line risk ownership is of paramount importance and is widely lacking at the same time. The available literature about the research topic proved to be rather scarce. Therefore, in particular a more extensive empirical research, with more case organisations, also in other countries than the Netherlands, might challenge the results of this paper.

The development part of the research builds on the risk management implementation approach as derived by Van Staveren (2009). Although the selected key conditions for the routine application of risk management were confirmed by Arena et al. (2010), Paté-Cornell and Cox (2014), and Oliveira et al. (2019), additional research might challenge or even falsify the selected key conditions. Also, additional, or other relevant key conditions might emerge. Furthermore, Van Staveren (2009) provides also key conditions for the social systems within organisations, which are omitted in view of the scope of this research. Including additional key conditions for risk management methods, as well as key conditions for social systems, may provide other or additional suggestions for developing first line risk ownership by second and third line professionals.

What can be remarked on the overall research quality? According to Aven (2020, p. 27), overall quality criteria for conceptual risk management research include clarity, innovativeness, potential impact, and validity. Specifically for problem solving in organisations, Van Aken et al. (2012) adds criteria for controllability and reliability.

Conceptual clarity is provided by building on well-established risk management approaches and risk definitions (e.g. COSO 2017; ISO 2018). Innovativeness is provided by key conditions that are derived from risk, innovation, and change management theories (Van Staveren 2009). Furthermore, the research topic in this paper seems to be the first in its kind about a highly relevant issue, at least as observed in The Netherlands. The potential impact of the research outcome can be substantial, due to the importance of first line risk management and its related ownership for organisations. The benefits of the easily accessible and pragmatic OUD-questions are experienced by the author in the Dutch practice, for instance in public organisations and in companies in the insurance sector. Therefore, despite inherent research limitations from a scientific point of view, the research outcome might become of considerable relevance from a professional practice point of view. Furthermore, the generic research results seem smoothly to use by first, second and third line managers and professionals in all sorts of organisations and sectors. Undeniably, for reasons of validity, controllability, and reliability, additional empirical and development research is recommended to further verify and generalise the findings in this paper.

In conclusion and by recalling the research question, what can second line controllers and third line internal auditors do to support first line risk ownership? Suggestions are (1) routinely asking first line managers and professionals for answering the three OUD-questions, (2) routinely clarifying objectives at all levels in organisations, and (3) routinely connecting responsibility for objectives to responsibility for the related risks and opportunities. Adopting this simplified and objective-driven risk management approach in all first line activities is expected to support first line risk management in organisations. It is after all recognised that these suggestions are no rocket science. To some scholars or practitioners these support suggestions may even sound obligatory. Nevertheless, this smoothly applicable approach facilitates three key conditions for first line risk management implementation: risk management becomes easy to apply within existing first line practices, it fulfils the needs of its first line users, and first line risk ownership will grow. It is now up to the second and third line professionals to start and foster this first line risk management development.

I would like to thank Chris Knoops and the two anonymous reviewers for their valuable feedback.