2. Enterprise Risk Management and Risk Governance

Introduction and Context

Real estate organisations operate through long investment horizons, substantial leverage, complex contractual relationships, regulatory exposure and assets that are highly sensitive to economic, environmental and social change. A development may take several years to plan and construct, while its financial consequences may continue for decades. Risks therefore arise not only from individual projects but also from the interaction of investment decisions, financing structures, operations, compliance obligations, technology, reputation and sustainability commitments.

Traditional risk management often treated risks as isolated events managed within departmental boundaries. A development team considered planning risk, the finance department considered interest-rate risk, and the facilities team considered operational risk. This approach can overlook relationships between risks. For example, a delayed planning approval may increase construction costs, postpone rental income, breach loan covenants and weaken investor confidence simultaneously. Enterprise risk management (ERM) addresses this problem by viewing risk as an organisation-wide matter connected to strategy, performance and governance.

Risk governance provides the institutional framework through which risks are directed, monitored and held accountable. It clarifies the responsibilities of the board, executive management, risk functions, operational teams, internal audit, investors and other stakeholders. In real estate, effective risk governance is not merely a compliance exercise. It influences which assets are acquired, how projects are financed, how developments are designed, how tenants and communities are treated, and whether long-term value is protected.

This chapter integrates ISO 31000, the COSO Enterprise Risk Management framework, risk appetite, the three-lines model, risk registers, heat maps, controls, key risk indicators and escalation protocols. The emphasis is on application: how a real estate organisation can convert broad principles into decisions, reporting routines and board-level oversight.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Explain the purpose and logic of enterprise risk management in real estate organisations.

2. Compare the main features of ISO 31000 and COSO ERM.

3. Distinguish risk capacity, risk appetite, risk tolerance and risk limits.

4. Apply the three-lines model to real estate governance.

5. Construct and interpret a risk register, risk matrix and control assessment.

6. Design useful key risk indicators and escalation protocols.

7. Evaluate how boards and executive committees should oversee risk.

8. Analyse an integrated risk scenario involving a real estate development.

9. Identify common weaknesses, ethical issues and emerging challenges in risk management.

Risk as an Enterprise and Strategic Concern

Risk is commonly understood as the effect of uncertainty on objectives. The effect may be negative, positive or both. In professional risk management, risk is not limited to the probability of loss. It includes uncertainty about outcomes and the possibility that actual performance will differ from objectives.

A real estate organisation normally has several classes of objectives:

• strategic objectives, such as portfolio growth, geographic diversification or development returns;
• financial objectives, such as net operating income, loan covenant compliance, cash flow and investment yield;
• operational objectives, such as building availability, tenant satisfaction and maintenance quality;
• compliance objectives, such as planning, building, health and safety, environmental and anti-money-laundering requirements; and
• reporting objectives, involving reliable financial, operational and sustainability information.

A useful distinction is between inherent risk and residual risk. Inherent risk is the exposure before considering controls. Residual risk is the exposure remaining after controls are applied. A high construction risk may be reduced through fixed-price contracts, performance bonds, independent inspections and contingency reserves, but it is rarely eliminated.

Risk interdependence is especially important in property. Market risk can affect valuations, which can affect loan-to-value ratios, which can trigger refinancing pressure. Climate risk can damage physical assets, interrupt operations and increase insurance costs. A data breach can produce financial loss, regulatory consequences and reputational damage. ERM seeks to identify these connections rather than treating each event as a separate administrative category.

ISO 31000 and COSO ERM: Complementary Perspectives

ISO 31000 presents risk management as a set of principles, a framework and a process. Its principles emphasise integration, structured and comprehensive practice, customisation, inclusiveness, dynamism, use of the best available information, consideration of human and cultural factors, and continual improvement. The framework connects leadership and commitment with integration, design, implementation, evaluation and improvement. The process generally includes communication and consultation, scope and context definition, risk assessment, risk treatment, monitoring and review, and recording and reporting.

The strength of ISO 31000 is its flexibility. A property company can adapt it to acquisitions, development projects, asset operations or corporate functions. It does not prescribe one universal risk taxonomy or scoring system. This is beneficial because a residential developer and a property investment trust may require different risk criteria.

COSO ERM links risk with strategy and performance. Its commonly used components include governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting. COSO asks whether the organisation understands the risks associated with its chosen strategy, evaluates the severity of risks, prioritises them, implements responses and learns from changing conditions.

The two frameworks are compatible but serve slightly different emphases. ISO 31000 provides an adaptable management process, while COSO ERM places stronger emphasis on governance, strategy, performance and internal control relationships. An organisation need not treat them as competing systems. It may use ISO 31000 for risk assessment and treatment while using COSO concepts to structure board oversight, performance reporting and accountability.

Risk Appetite and Decision Boundaries

Risk appetite is the amount and type of risk an organisation is willing to pursue or retain in the pursuit of its objectives. It is a strategic statement, not simply a numerical score. A board may approve moderate exposure to development risk in carefully selected markets but have minimal appetite for bribery, unsafe working conditions, sanctions violations or deliberate misrepresentation of sustainability information.

Four related concepts should be distinguished:

• Risk capacity is the maximum risk the organisation can absorb without threatening its viability, licence to operate or essential obligations.
• Risk appetite is the level and type of risk the organisation is willing to accept in pursuit of its strategy.
• Risk tolerance is the acceptable variation around a specific objective or risk appetite statement.
• Risk limit is an operational threshold beyond which action, approval or escalation is required.

For example, a board may express an appetite for selective development exposure, establish a portfolio loan-to-value tolerance of 55 per cent, and impose a 60 per cent hard limit. A project approaching the tolerance level may require management attention; a breach of the hard limit may require immediate escalation and a corrective plan.

Risk appetite statements should be specific enough to guide decisions. “We have a balanced appetite for risk” is too vague. A stronger statement might specify preferred development geographies, maximum concentration in one market, minimum interest coverage, acceptable vacancy levels, prohibited counterparties and zero tolerance for serious health and safety misconduct. Appetite should also address qualitative matters that cannot be reduced easily to a single metric.

Governance Architecture and the Three Lines

The board has ultimate responsibility for overseeing risk, approving risk appetite and ensuring that management has suitable systems to identify and respond to material exposures. It does not manage every risk directly. Its role is to challenge assumptions, review significant exposures, monitor breaches and satisfy itself that risk information is reliable.

Executive management translates board-approved appetite into policies, limits, budgets, delegated authorities and operating procedures. The chief executive and senior executives must ensure that risk is considered in acquisitions, capital allocation, development approvals, financing and asset operations.

The three-lines model clarifies organisational responsibilities:

1. First line: management and operational functions. Project directors, asset managers, finance teams, procurement staff and property managers own risks and operate controls. They are responsible for identifying problems rather than transferring responsibility to a risk department.

2. Second line: risk, compliance and specialist oversight. These functions develop methodologies, advise management, monitor risk exposure, review policy compliance and aggregate information for senior committees. They should have sufficient independence to challenge the first line.

3. Third line: internal audit. Internal audit provides independent and objective assurance on governance, risk management and controls. It does not own operational risks or design controls that it will later audit.

The board and its committees sit above the three lines as governing bodies. External auditors, regulators, lenders, insurers and specialist advisers provide additional assurance but do not replace management accountability. Confusion frequently arises when the risk function is expected to “own” every risk. Such an arrangement weakens accountability because operational managers may assume that risk belongs to someone else.

Building a Real Estate Risk Register

A risk register is a structured record of material risks, their causes, consequences, controls, owners, ratings and treatment actions. It should support decisions rather than become a static catalogue. A practical register may contain the following fields:

• risk title and clear description;
• causes or drivers;
• potential consequences;
• affected strategic or operational objectives;
• inherent likelihood and impact;
• existing controls;
• residual likelihood and impact;
• risk owner;
• treatment actions, deadlines and accountable persons;
• key risk indicators;
• escalation requirements; and
• date of next review.

Risk descriptions should state cause, event and effect. “Interest rates” is not a sufficiently useful description. “A rapid rise in benchmark interest rates increases debt service costs and causes the project to breach its interest coverage covenant” is more actionable.

Risk identification can use workshops, interviews, document review, scenario analysis, historical incidents, due diligence and external intelligence. Participants should include people with different perspectives: development, finance, legal, operations, sustainability, procurement and community engagement. A register prepared only by the risk department is likely to omit practical knowledge.

Risk assessment may be qualitative, quantitative or a combination. Qualitative scales are useful when data are limited, but definitions must be consistent. For instance, “high impact” might mean a material covenant breach, a fatality, a major regulatory sanction or a substantial loss of asset value. A five-by-five matrix can prioritise attention, but it should not create false precision. Two risks with the same score may require entirely different responses.

Controls, Treatments and Assurance

Risk treatment involves avoiding, reducing, sharing, transferring, accepting or pursuing risk. A proposed development might be rejected to avoid unacceptable planning or contamination exposure. Construction risk may be reduced through staged approvals and independent technical review. Insurance can transfer some financial consequences, but it does not transfer accountability for safety or legal compliance. Risk acceptance should be explicit and within delegated authority.

Controls may be preventive, detective or corrective. A segregation-of-duties requirement is preventive; a monthly covenant review is detective; and a business-continuity plan is corrective. Controls can also be manual, automated or hybrid. Their quality depends on design and operation. A control designed to review all supplier payments is not effective if the review is performed late, lacks evidence or is conducted by an interested party.

Control assessment should ask:

• Is the control relevant to the stated risk?
• Is responsibility clearly assigned?
• Does it operate at the required frequency?
• Is there evidence that it operated?
• Is the reviewer sufficiently competent and independent?
• Are exceptions tracked to closure?

A control framework should not become excessively bureaucratic. Too many low-value controls can obscure the controls that matter most. The objective is reasonable assurance, not the elimination of all uncertainty.

Heat Maps, Key Risk Indicators and Escalation

A heat map displays risks according to likelihood and impact. It is useful for communicating priorities to executives and boards, particularly when a portfolio contains many exposures. However, heat maps have limitations. They may encourage ranking rather than understanding, conceal interdependencies and overemphasise risks that are easy to score. Board reports should therefore supplement the map with trends, movement since the previous period, management actions, emerging risks and decisions required.

Key risk indicators (KRIs) are measures that signal changing exposure. A useful KRI has a defined owner, data source, frequency, threshold and response. Examples include:

• loan-to-value ratio and interest coverage;
• percentage of construction budget committed;
• cost variance and schedule slippage;
• vacancy and tenant arrears;
• overdue statutory inspections;
• near-miss and lost-time injury rates;
• insurance claims and uninsured exposure;
• energy intensity and carbon emissions;
• concentration of income by tenant or market; and
• unresolved high-severity audit findings.

A KRI is not automatically useful merely because it is measurable. A lagging indicator, such as realised cost overruns, may confirm that a problem has already occurred. Leading indicators, such as procurement delays, declining contractor liquidity or rising design changes, may provide earlier warning.

Escalation protocols establish what happens when a threshold is reached. A simple protocol may use green, amber and red conditions. Green indicates operation within approved limits. Amber requires management review, an action plan and closer monitoring. Red requires immediate notification of the relevant executive or board committee, documented decision-making and a defined recovery or contingency plan. Escalation should be timely and non-punitive; otherwise employees may suppress bad news.

Board-Level Oversight and Reporting

Effective board reporting is selective, forward-looking and decision-oriented. A board should receive information on the organisation’s top enterprise risks, changes in exposure, breaches of appetite or limits, significant incidents, emerging risks, control weaknesses and the effectiveness of management responses. It should also understand the assumptions behind valuations, forecasts and stress tests.

Board oversight is strengthened when reports distinguish between:

• the current risk position;
• the desired position under the risk appetite;
• the direction of travel;
• management’s proposed response; and
• the decision or challenge required from the board.

The board should periodically test whether risk reporting is complete. It can ask what risks are not represented in the register, which assumptions would cause the business plan to fail, whether incentives encourage excessive risk-taking, and whether management is reporting bad news promptly. Scenario analysis is particularly useful. Examples include a severe interest-rate increase, a major tenant failure, a prolonged construction delay, a flood affecting several assets, a cyberattack on building systems or a sudden loss of refinancing capacity.

Risk committees can provide detailed review, but committee structures should not fragment accountability. Matters that affect strategy, capital or organisational resilience should reach the full board. Minutes should record material challenge, decisions, dissent and follow-up responsibilities.

Illustrative Case: The Riverside Mixed-Use Development

Background

The following is a fictional case designed for educational purposes. Meridian Properties, a diversified real estate company, proposes a mixed-use development containing residential units, offices, retail space and a public riverside area. The project is expected to take thirty months and will be financed partly through variable-rate debt. The site is attractive but has a history of industrial use and lies in an area exposed to surface-water flooding.

Situation and Problem

The investment committee initially receives a feasibility report showing an attractive projected return. However, the project team has not fully quantified remediation costs, flood adaptation requirements or the effect of higher interest rates. A major contractor is financially weak, and the proposed anchor office tenant has not completed its lease commitment. The risk register lists these matters but rates each as medium because management expects them to be resolved.

Analysis

Using an ISO 31000 process, the organisation defines the project context, objectives and risk criteria. A cross-functional workshop identifies linked risks: contamination may delay planning and increase costs; flood adaptation may change design; delay may increase interest expense; and the loss of the anchor tenant may reduce financing confidence. Under COSO ERM principles, the risks are assessed not only as project issues but as threats to portfolio liquidity and strategic growth objectives.

The board-approved appetite permits development risk but does not permit a project to threaten covenant compliance or involve unacceptable safety or environmental exposure. The project’s initial loan-to-value ratio is within the limit, but stress testing shows that a twelve-month delay combined with higher rates would breach the interest coverage threshold.

Approach and Solution

The committee requires several conditions before final approval. First, independent environmental testing and a costed remediation plan must be completed. Second, the design must include verified flood-resilience measures and an emergency operating plan. Third, financing is amended to include an interest-rate hedge and a larger liquidity reserve. Fourth, contractor appointment is made conditional on financial due diligence, parent support and performance security. Fifth, the anchor tenant must sign a binding agreement or the project must be re-underwritten using a conservative leasing assumption.

The risk register is revised with named owners. KRIs include remediation cost variance, critical-path delay, contractor payment stress, committed leasing percentage, forecast interest coverage and flood-design approval status. Amber thresholds trigger monthly executive review; red thresholds require investment committee and board risk committee notification.

Outcome

The environmental investigation identifies additional remediation work. The project remains viable, but the expected return is lower than initially presented. Because the issue is discovered before construction, the board can either renegotiate the land price or defer approval. The contractor’s financial position subsequently deteriorates, and Meridian replaces it before mobilisation, avoiding a later failure. The project opens several months late but remains within revised funding limits.

Learning Points

The case illustrates that attractive returns do not justify weak risk analysis. Risk registers must describe causes and consequences, not merely labels. Stress testing reveals interactions that individual risk ratings can miss. Appetite statements provide decision boundaries, while KRIs and escalation protocols convert governance principles into action. Independent assurance is especially valuable where project teams have incentives to present optimistic forecasts.

Challenges, Limitations and Common Mistakes

Several weaknesses commonly reduce the effectiveness of ERM in real estate organisations. The first is compliance-oriented risk management, in which staff complete registers and reports without influencing investment decisions. The second is excessive reliance on heat maps. A coloured matrix may create an appearance of control while concealing poor data or correlated exposures.

Other mistakes include assigning risk ownership to a central risk officer rather than operational management; failing to update risks after acquisitions or major changes; treating insurance as a substitute for prevention; using vague appetite statements; selecting KRIs that are easy to collect but irrelevant to decision-making; and escalating only confirmed incidents rather than credible warning signs.

Risk models also have limitations. Property valuations depend on assumptions about rents, yields, costs and liquidity. Historical data may not represent unusual climate, economic or geopolitical conditions. Quantitative precision can therefore be misleading. Professional judgement remains necessary, but judgement should be documented, challenged and reviewed.

A further challenge is organisational culture. If managers are rewarded only for growth or project completion, they may understate risk. A mature culture encourages challenge, protects legitimate whistleblowing and treats near misses as learning opportunities. Accountability should distinguish between good-faith judgement under uncertainty and negligence or concealment.

Ethical, Regulatory and Professional Considerations

Risk governance has an ethical dimension because decisions affect tenants, employees, contractors, communities, lenders and future users of buildings. Organisations should not manipulate valuations, conceal defects, misrepresent environmental performance or shift avoidable hazards to vulnerable communities. Conflicts of interest in procurement, land acquisition and leasing must be disclosed and managed.

Regulatory obligations vary by jurisdiction but commonly include planning, building safety, occupational health and safety, environmental protection, data protection, financial reporting, anti-bribery and anti-money-laundering requirements. Compliance should be integrated into business processes rather than treated as a final approval hurdle.

Sustainability reporting creates a particular governance challenge. Claims about energy performance, emissions or climate resilience should be supported by reliable data and appropriate assurance. Greenwashing is not only a reputational concern; it may produce litigation, regulatory intervention and loss of investor trust.

Digital Risk Management and Emerging Developments

Real estate organisations increasingly use integrated risk platforms that connect property data, project controls, finance, maintenance, incident management and sustainability metrics. Automated dashboards can compare actual performance with thresholds and distribute alerts. Building-management systems may identify abnormal energy use, equipment failure or occupancy changes.

Artificial intelligence can support document review, forecasting, anomaly detection and scenario analysis. Nevertheless, AI outputs depend on data quality and model assumptions. Governance should address access rights, explainability, cyber resilience, human review and the risk of embedding historical bias. Automated alerts should not replace professional judgement, particularly where safety, legal rights or community impacts are involved.

Emerging risk priorities include physical and transition climate risk, cyberattacks on connected buildings, supply-chain fragility, changing disclosure expectations, construction-sector insolvency, demographic shifts and the affordability consequences of development decisions. Boards should ensure that emerging risks are discussed before they become routine entries in an incident report.

Best-Practice Principles for Real Estate ERM

A sound real estate ERM system generally demonstrates the following characteristics:

• risk is integrated into strategy, budgets, acquisitions and project gates;
• the board approves clear appetite statements and receives concise, reliable information;
• operational managers own risks and controls;
• risk, compliance and internal audit retain appropriate independence;
• risk descriptions identify causes, events and consequences;
• controls are tested for both design and operation;
• KRIs are forward-looking where possible and linked to explicit actions;
• stress testing examines interconnected and non-linear effects;
• escalation is timely, documented and free from retaliation;
• sustainability, safety and ethical risks receive equal seriousness with financial risks; and
• the framework is reviewed after incidents, near misses, strategic changes and external developments.

Chapter Summary

Enterprise risk management enables real estate organisations to understand uncertainty in relation to strategy, performance and long-term value. ISO 31000 provides an adaptable process based on context, assessment, treatment, monitoring and communication. COSO ERM connects risk with governance, strategy, performance and reporting. Risk appetite translates strategic intent into boundaries through the related concepts of capacity, tolerance and limits.

The three-lines model assigns ownership to operational management, oversight to risk and compliance functions, and independent assurance to internal audit. Risk registers, heat maps, controls and KRIs make exposure visible, but they are effective only when based on clear definitions, reliable information and action-oriented escalation. Boards must challenge assumptions, review interconnected risks and ensure that material breaches and emerging threats receive attention. Ethical conduct, sustainability, data quality and organisational culture are central to effective risk governance, not separate concerns.

Key Terms

Risk: The effect of uncertainty on objectives.

Enterprise risk management: An organisation-wide approach that integrates risk with strategy, performance and decision-making.

Inherent risk: Exposure before controls or treatments are applied.

Residual risk: Exposure remaining after controls and treatments.

Risk appetite: The amount and type of risk an organisation is willing to pursue or retain.

Risk capacity: The maximum risk an organisation can absorb without threatening viability or essential obligations.

Risk tolerance: Permitted variation around a specific objective or appetite statement.

Risk limit: A defined operational threshold requiring action or escalation when exceeded.

Risk governance: Structures, responsibilities and processes through which risk is directed and overseen.

Risk register: A structured record of risks, controls, owners, ratings and treatments.

Risk owner: The person accountable for managing a specified risk.

Heat map: A visual display of risks according to likelihood and impact.

Key risk indicator: A measure that signals a change in risk exposure.

Preventive control: A control designed to stop an unwanted event from occurring.

Detective control: A control designed to identify an event or condition after it occurs.

Corrective control: A control designed to restore or improve conditions after an event.

Three-lines model: A governance model distinguishing operational ownership, oversight and independent assurance.

Stress testing: Analysis of performance under adverse but plausible conditions.

Residual risk: The level of risk remaining after control measures are considered.

Risk escalation: The formal communication and response process triggered by a threshold, breach or material change.

Review Questions

Short Answer Questions

1. Distinguish inherent risk from residual risk using a real estate example.

2. What is the purpose of a risk appetite statement?

3. Identify the responsibilities of the first and second lines in the three-lines model.

4. What information should a useful risk register contain?

5. Why can a heat map create a misleading impression of precision?

Long Answer Questions

1. Compare ISO 31000 and COSO ERM and explain how a real estate organisation could use both.

2. Explain the relationship between risk capacity, risk appetite, risk tolerance and risk limits.

3. Discuss the role of the board in enterprise risk management and risk governance.

4. Explain how controls should be designed, assessed and tested in a property development organisation.

5. Discuss how ethical conduct, sustainability and organisational culture affect real estate risk governance.

Analytical / Application Questions

1. A property company is approaching its loan-to-value limit because of falling valuations. Design an escalation protocol using appetite, tolerance, KRIs and management actions.

2. Construct a risk-register entry for the possibility that a major construction contractor becomes insolvent during a development project. Include causes, consequences, controls, owner, KRIs and treatment actions.

3. A board receives a green heat map even though construction costs, tenant commitments and interest rates are all deteriorating. Analyse why the reporting system may be failing and recommend improvements.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes enterprise risk management in a real estate organisation?

A. It is a process used only by the internal audit department.

B. It integrates risk considerations with strategy, performance and decision-making across the organisation.

C. It eliminates all uncertainty from property investment.

D. It focuses exclusively on insurable physical damage.

Correct Answer: B. It integrates risk considerations with strategy, performance and decision-making across the organisation.

Question 2

What is the principal emphasis of COSO ERM compared with a narrowly defined risk checklist?

A. Linking risk with governance, strategy and performance.

B. Replacing management responsibility with internal audit responsibility.

C. Using only quantitative risk measurements.

D. Limiting risk analysis to construction activities.

Correct Answer: A. Linking risk with governance, strategy and performance.

Question 3

A board permits moderate development exposure but prohibits any risk that could threaten covenant compliance. This statement primarily expresses the organisation’s:

A. Risk register.

B. Risk appetite.

C. Control deficiency.

D. Audit universe.

Correct Answer: B. Risk appetite.

Question 4

Which activity belongs primarily to the first line of the three-lines model?

A. Providing independent assurance on controls.

B. Setting external accounting standards.

C. Owning operational risks and operating controls.

D. Aggregating risks independently for the board.

Correct Answer: C. Owning operational risks and operating controls.

Question 5

Which risk description is most useful for a risk register?

A. Interest rates.

B. Financing issue.

C. A rapid rise in interest rates increases debt service costs and may breach the project covenant.

D. Financial risk: medium.

Correct Answer: C. A rapid rise in interest rates increases debt service costs and may breach the project covenant.

Question 6

A monthly review of interest coverage that identifies possible covenant breaches is best classified as a:

A. Preventive control.

B. Detective control.

C. Corrective control.

D. Risk appetite statement.

Correct Answer: B. Detective control.

Question 7

What makes a key risk indicator most useful?

A. It is measurable, but has no assigned response.

B. It is reported only after a loss has occurred.

C. It has an owner, data source, frequency, threshold and defined action.

D. It is selected because it is easy to collect.

Correct Answer: C. It has an owner, data source, frequency, threshold and defined action.

Question 8

In the Riverside case, stress testing was valuable mainly because it:

A. Guaranteed that the project would achieve its original return.

B. Revealed how delay and higher interest rates could interact to threaten financing capacity.

C. Removed the need for environmental investigation.

D. Transferred all project risk to the contractor.

Correct Answer: B. Revealed how delay and higher interest rates could interact to threaten financing capacity.

Question 9

Which board-reporting practice is most consistent with effective risk governance?

A. Reporting only risks that have already caused losses.

B. Presenting a heat map without trends or management actions.

C. Showing current exposure, movement, appetite position and decisions required.

D. Delegating all material risk decisions to internal audit.

Correct Answer: C. Showing current exposure, movement, appetite position and decisions required.

Question 10

Why should an organisation avoid treating insurance as a complete solution to safety risk?

A. Insurance always increases operational risk.

B. Insurance may transfer some financial consequences but does not transfer accountability for prevention and compliance.

C. Insurance cannot cover any property-related event.

D. Insurance is part of the third line and cannot be used by management.

Correct Answer: B. Insurance may transfer some financial consequences but does not transfer accountability for prevention and compliance.