Paragraph 91/2 of the Stock Corporation Law (IDW PS 340) requires public limited companies to establish a system of measures and control instruments that are able to identify developments, at an early stage, that might negatively affect the continued existence of the company. A similar stipulation can be found in paragraph 264 HGB (Commercial Code) which is generally applicable to corporations. This is done by implementing a risk management system.

In this context, risk management systems are regulatory instruments for public limited companies. An important pillar of such systems is the identification of risks systematically and early on. Companies need to establish a risk management process and control for vital business figures. Though every company can develop its own system, these systems should ideally include the following aspects:

• internal risks - affecting business operation (such as organisational or financial risks); and
• external risks - resulting from changes in the business environment (such as technological change or force majeure).

Early knowledge of potential internal and external risks will help companies to develope suitable solutions in response. Naturally, risk profiles can vary by region and sector. As companies work in a constantly changing environment, risk identification and controlling also need to be conducted on a continuous basis.