Decision-Oriented Risk Management as a Legal Mandate: Evidence on Risk Aggregation, Risk-Bearing Capacity, and the Implementation of StaRUG and FISG in German DAX and MDAX Companies

Abstract

The decision-oriented conception of enterprise risk management (ERM), in which risks are quantified, aggregated, and weighed against return when business decisions are prepared, is increasingly regarded as the core of value-based management. In Germany, this conception acquired a legal foundation in 2021: Section 1 of the Stabilization and Restructuring Framework for Enterprises Act (StaRUG), the Financial Market Integrity Strengthening Act (FISG), and the amended Section 91(3) of the German Stock Corporation Act (AktG) require continuous monitoring of developments that may jeopardize the company’s continued existence, the initiation of “appropriate countermeasures” once a critical threshold is exceeded, and direct communication of the risk situation to the supervisory board. This paper argues that these obligations are difficult to satisfy without risk aggregation by Monte Carlo simulation and a quantitative risk-bearing-capacity concept, the same apparatus that underpins simulation-based valuation. The study asks whether listed firms report using it. The 2021 annual reports of 83 DAX- and MDAX-listed companies (excluding banks, exchanges, and insurers) are scored against eleven criteria capturing disclosed risk management practice. Because the instrument reads public reporting rather than internal process, the scores are interpreted throughout as a lower bound on practice. The average score is 0.73 of a possible 2.0 (about 37%). StaRUG is named by no company; FISG is by roughly 31%; and only a minority disclose adequate risk aggregation or a risk-bearing-capacity concept with a defined threshold. The pattern, near-universal assertion of readiness to act, combined with near-absence of the quantitative apparatus that would make such action triggerable, is consistent with ceremonial conformity decoupled from substantive practice. The value-relevant core of risk management thus remains largely unreported. Because the same apparatus generates the cost of capital and the decision value used in simulation-based valuation, the scores also function as a diagnostic of valuation capability: a firm that cannot aggregate its risks must import a discount rate rather than derive one. This has implications for valuation, governance, supervisory oard liability, and audit.

1. Introduction

Risk management contributes to corporate success when risks are adequately considered in the preparation of business decisions. This decision-oriented understanding of risk management, the requirement to weigh return against risk before a decision is taken, is the basis of value-based management and is emphasized internationally by the COSO Enterprise Risk Management Framework (COSO, 2017). Its central methodological building blocks are the quantification of individual risks, their aggregation in the context of corporate planning (typically by Monte Carlo simulation), and the translation of the resulting risk profile into value-relevant figures such as the cost of capital, the probability of insolvency, or the degree to which the continued existence of the company is threatened.

In Germany, this conception is no longer merely a matter of good practice. Since 1 January 2021, the Act on the Stabilization and Restructuring Framework for Enterprises (StaRUG) and the Financial Market Integrity Strengthening Act (FISG) have substantially expanded the statutory requirements for risk management. Beyond the early detection of “developments that could jeopardize the continued existence of the company,” Section 1 StaRUG requires, where necessary, the initiation of “appropriate countermeasures” and the notification of the supervisory board. The amended Section 91(3) of the German Stock Corporation Act (Aktiengesetz, AktG) requires a comprehensive and effective risk management system, and Section 107 AktG strengthens the direct line of communication between risk management, internal audit, and the supervisory board (audit committee).

The argument developed in this paper is that these legal requirements are, in substance, a codification of decision-oriented risk management. Continuous monitoring of the degree of existential threat, the definition of a threshold above which countermeasures must be triggered, and the obligation to keep the supervisory board informed cannot be satisfied without (i) aggregating risks across the corporate plan to determine the probability of a covenant breach, rating downgrade, or insolvency and (ii) implementing a risk-bearing-capacity concept that converts that aggregate into a usable metric. These are the same methods that underpin simulation-based corporate valuation and value-based management. Whether listed German companies implement them is therefore a question about more than legal compliance; it is a question of whether they possess the apparatus on which decision-oriented valuation depends. That reframing is what this paper adds. The eleven criteria used below are not read here solely as a compliance checklist; each is mapped onto a specific input of a simulation-based valuation, so that a firm’s score is simultaneously a statement about its legal position and about what it is able to value. A firm that cannot aggregate its risks over its corporate plan cannot derive its cost of capital from its own risk position, cannot compute a decision value for a project against its own risk profile, and cannot therefore weigh return against risk in the manner that both Section 93 AktG and value-based management presuppose. The bridge from risk analysis to risk aggregation and from risk aggregation to simulation-based valuation is thus the argumentative spine of the paper rather than an implication drawn at the end of it.

This study addresses that question empirically. This English-language article develops a study first published in German as Jungesblut (2024). It draws on the same hand-coded disclosure dataset and adds newly collected financial data and a multivariate analysis, a decision-oriented and valuation framing, a theoretical account of the results, and the international literature positioning. It builds on earlier studies of risk reporting by German DAX and MDAX companies conducted before 2021, which, by construction, could not yet assess the expanded StaRUG and FISG requirements (Köhlbrandt et al., 2020; Berger & Gleißner, 2007), and it analyses the 2021 annual reports of 83 DAX- and MDAX-listed companies, excluding firms from the banking, stock exchange, and insurance sectors, which are subject to separate sectoral risk management regimes. Eleven criteria are used to assess the extent to which risk management has been developed in line with the new requirements and with their decision-oriented and value-relevant content.

The gap this addresses is not just a German one. The business economics methods needed to translate risk aggregation into cost of capital and value-based management are by now available in the research literature, but substantial gaps remain in their practical implementation within companies, and the barriers to that implementation are themselves a priority for future research (see also Hiebl, 2024, on the integration of risk into management control systems). A structured review of the ERM literature reaches a complementary conclusion from the opposite direction: risk aggregation, risk quantification, and decision support are addressed in only a small number of publications, so the methods are neither well covered by the research literature nor widely adopted in practice (Gleißner & Berger, 2024; Bromiley et al., 2015).

The international ERM literature has approached the adjacent question largely through maturity-and-performance studies (McShane et al., 2011; Farrell & Gallagher, 2019; Beasley & Branson, 2022), through evidence on risk awareness as a barrier to adoption (Braumann, 2018), through conceptual work on risk governance (Stein & Wiedemann, 2016; Otter et al., 2026), and through reviews of the relationship between enterprise risk management and managerial judgement (Kaplan & Mikes, 2016; Crawford & Jabbour, 2024; Nocco & Stulz, 2022). Evidence specific to the German-speaking setting is thinner, and what exists largely predates the legislation examined here (Hiebl et al., 2019; Grammenidis & Hiebl, 2021). What is missing on both sides is direct evidence on whether the specific methodological apparatus—quantification, planning-based aggregation, and the translation of aggregate risk into a valuation parameter—is actually in place in large listed firms. Grisar and Meyer (2015) offer the closest precedent, finding limited use of Monte Carlo simulation in German, Austrian, and Swiss controlling departments, but their study predates the statutory requirements examined here and addresses the controlling function rather than risk management. The present study supplies that evidence for a setting in which the apparatus is not merely recommended but legally required.

The paper makes three contributions. First, it provides the first empirical assessment of the extent to which the risk management requirements introduced by StaRUG and FISG are reflected in the reporting of German listed companies. Second, it supplies an explicit mapping from each disclosure criterion to an input of simulation-based valuation, so that the results can be read as a diagnostic of valuation capability and not only of regulatory conformity; this connects the literature on legal compliance to the literature on risk-adjusted valuation that has largely developed separately from it. Third, it interprets the resulting pattern through the lens of decoupling, which yields a testable expectation about the shape of the results rather than a description of them. The research question is accordingly twofold: to what extent do German DAX and MDAX companies disclose the risk quantification, risk aggregation, and risk-bearing-capacity apparatus that Section 1 StaRUG and Section 91(3) AktG require; and what does the observed pattern imply for their capacity to value their own decisions? The remainder of the paper is structured as follows: Section 2 sets out the expanded requirements and reviews the state of risk management “before StaRUG.” Section 3 describes the data, states the scoring instrument and its dependency structure, and lists the eleven criteria. Section 4 presents the results, disaggregated by criterion, index, sector, and top-performing companies, and relates the scores to firm characteristics. Section 2.3 sets out the theoretical framing and derives the competing expectations that the data are read against. Section 5 interprets the findings: Section 5.1 develops the chain from risk analysis through risk aggregation to simulation-based valuation and the decision value and reads each criterion against it; Section 5.2 and Section 5.3 discuss implications for governance and audit and set out the limitations of the study.

2. Requirements for Risk Management and Their Fulfilment

2.1. Requirements Since StaRUG and FISG

Since 1998, the statutory minimum requirements for the risk management of a German stock corporation (Aktiengesellschaft, AG) have been shaped principally by the Act on Control and Transparency in Business (Kontroll- und Transparenzgesetz, KonTraG). A significant extension follows from Section 93 AktG, the Business Judgement Rule, from which a decision-oriented orientation of risk management can be derived (Graumann et al., 2009), an orientation that has been reflected internationally since 2017 in the COSO ERM Framework (COSO, 2017; Hunziker, 2025).

Since 1 January 2021, StaRUG has imposed new requirements on the risk management of stock corporations, limited-liability companies (GmbH), and limited partnerships with a limited-liability general partner (GmbH & Co. KG). StaRUG is relevant not only for companies already in crisis but generally for all limited-liability enterprises. At the outset, it formulates general requirements for crisis early detection, and thus for risk management, for all limited-liability organizations and their governing bodies and shareholders (Nickert & Nickert, 2021). Section 1(1) StaRUG obliges the managing directors of a legal person to monitor continuously developments that may jeopardize the continued existence of the legal person; where such developments are identified, to take appropriate countermeasures; and to report without delay to the bodies responsible for supervising management (Weitzmann, 2021).

The first sentence corresponds to the older KonTraG requirement under Section 91(2) AktG, according to which systems for the early detection of “developments that could jeopardize the continued existence of the company” must be established, a requirement whose radiating effect on the GmbH has long been recognized (cf. Section 289 HGB). StaRUG, however, goes beyond the earlier requirements of the 1998 KonTraG. Managing directors are now obliged to take “appropriate countermeasures” and to inform the supervisory body when a severe, existence-threatening, crisis looms.

The central aspects of the heightened requirements are therefore (a) continuous monitoring to detect existence-threatening developments; (b) where needed, the initiation of “appropriate countermeasures”; and (c) the provision of information to the supervisory body (supervisory board).

Implicit in these requirements is the further need, alongside risk analysis and risk aggregation, to implement a risk-bearing-capacity concept (DIIR & RMA Working Group, 2022, on DIIR Standard No. 2). Such a concept measures, through suitable metrics such as the probability of existential threat, the “degree to which the continued existence of the company is threatened.” It is for the supervisory body to determine the degree of existential threat above which the statutorily mandated “appropriate countermeasures”, and the information of the supervisory body itself must be initiated (Gleißner, 2021).

It is an express intention of the legislator, through Section 1 StaRUG and the FISG, to hold the supervisory board even more firmly to account than before. The supervisory board must be informed without delay when the degree of existential threat exceeds a “critical threshold.” Above this threshold, the initiation of the “appropriate countermeasures” for crisis prevention is required. These measures may range from individual risk-reduction actions, through the strengthening of risk-coverage potential (e.g., a capital increase), to a full restructuring plan. Setting this threshold is a task of the supervisory board, as is monitoring the implementation of the legal requirements. So that the supervisory board is informed about the risk situation without possible interference from the management board, Section 107 AktG now explicitly provides for direct communication between risk management (and internal audit) and the supervisory board (audit committee). This is intended to ensure that deficiencies in risk management known within the function itself or uncovered by internal audit, such as a missing or methodologically inadequate risk aggregation, are also communicated to the supervisory board.

2.2. The State of Risk Management and the Role of the Statutory Audit

Earlier studies have already shown considerable room for improvement in the risk management of German companies generally (Ulrich et al., 2018a, 2018b) and of even large German stock corporations in particular. A study of risk management in DAX and MDAX companies conducted before StaRUG paints the following picture (Köhlbrandt et al., 2020):

• For most DAX and MDAX companies, it is not evident that they define what constitutes an “existence-threatening development.” It therefore remains doubtful whether, for example, existence-threatening developments arising from the breach of credit covenants or of minimum rating requirements are examined. Risk-bearing capacity is often disregarded.
• Information on the “degree of existential threat” is rarely found. This degree could be expressed through the probability of existential threat or the probability of insolvency (or a rating as a measure of insolvency risk).
• For many companies, it must be doubted whether existence-threatening developments are also recognized from the combined effect of several individual risks (as required by IDW PS 340 and DIIR Standard No. 2). The risk aggregation needed for this, based on corporate planning and typically implemented as a Monte Carlo simulation, examining the effect of several risks on covenants and the rating, is not performed by many companies (roughly three-quarters). For more than 90% of the companies examined, it is moreover not evident that the required aggregation of risks is also carried out “over time” (i.e., across several years).
• Only a few companies make it evident that systematic risk management is consistently incorporated into the preparation of “entrepreneurial decisions” within the meaning of Section 93(1) AktG (see DIIR Standard No. 2). Alongside deficits in risk quantification itself, the study shows that the information produced by risk management is still hardly used in determining unbiased (“expectation-true”) plan values, in deriving the equity requirement, or in estimating the cost of capital (Behringer & Gleißner, 2021).

These deficits are mirrored in the Risk Management Benchmark Study by Deloitte (2020), reported also in Link et al. (2021): on that evidence, at most 24% of companies perform a methodologically adequate risk aggregation, while 43% report performing an “addition of expected loss values,” which does not help to identify an existential threat. A more recent 2023 study reports a roughly twice-as-high rate of adequate aggregation (Scheffler & Flath, 2023).

A central reason for the slow uptake lies in the scope of the statutory audit. An audit under IDW PS 340 covers, as the standard itself makes clear, only the requirement for a risk-early-detection system under Section 91(2) AktG (Schmidt & Henschel, 2021). Other statutory requirements are not the subject of the audit and are therefore not examined. This concerns, on the one hand, the implications of Section 93 AktG and, of course, the requirements arising from StaRUG, in force since 1 January 2021, which were not yet relevant at the time IDW PS 340 (revised) was published in 2020.

The implications of the Business Judgement Rule under Section 93 AktG for risk management have been taken up since 2018 in DIIR Standard No. 2 but not in IDW PS 340. Under Section 93 AktG, adequate information must be documented for entrepreneurial decisions in order to avoid a breach of the duty of care, and the burden of proof lies with the management board (Graumann, 2014; Risk Management Association, 2019). Because entrepreneurial decisions have uncertain consequences, the decision template must show the implications of the decision for the overall risk position (Internationaler Controller Verein, 2021). This means that risk analyses must already be incorporated when decisions are prepared. Consistently, DIIR Standard No. 2 requires the inclusion of risk management in the preparation of entrepreneurial decisions; whether and to what extent this occurs is not examined in a statutory audit under IDW PS 340.

Following the FISG, direct communication between the internal control system, internal audit, and risk management with the supervisory board (audit committee) is now provided for (Section 107 AktG; Velte & Eulerich, 2021), so as to improve the supervisory board’s knowledge of the risk situation and of the state of risk management. In addition, the new Section 91(3) AktG requires a comprehensive and effective risk management system that goes beyond the previously required risk-early-detection system under Section 91(2). Such a system is to concern itself, in particular, with all economically material opportunities and threats (risks), even where these do not, individually or in combination, lead to an existence-threatening development. Alongside early detection, the explicit focus is now also on the management of risks, their mitigation, and targeted steering to improve the return–risk profile. Such risk management is intended to achieve not only crisis early detection but also crisis prevention and, in particular, to improve the quality of entrepreneurial decisions under Section 93 AktG.

2.3. Theoretical Framing: Mandate, Disclosure, and Decoupling

The legal analysis above establishes what StaRUG and FISG require. It does not, on its own, generate an expectation about what firms will do in response, and the empirical literature gives ample reason not to assume that a statutory mandate translates into practice. The framing adopted here is drawn from neo-institutional theory and, specifically, from the concept of decoupling (Meyer & Rowan, 1977; Bromley & Powell, 2012).

The argument runs as follows: Organizations operating under regulatory or normative pressure adopt the structures that signal conformity to that pressure because conformity confers legitimacy, and legitimacy is a condition of continued access to capital, customers, and regulatory forbearance. Adoption of the signaling structure, however, need not extend to the working practices the structure nominally describes. Where the mandated practice is costly, technically demanding, or difficult for outsiders to verify and where the enforcement regime does not inspect it, the efficient organizational response is to adopt the appearance and postpone the substance. The policy is written, the committee is constituted, the assurance is given and the operating routine is unchanged.

Three features of the StaRUG and FISG setting make it an unusually clean case for this mechanism. First, the mandated apparatus is technically demanding and expensive: risk aggregation by Monte Carlo simulation over a corporate plan requires quantified risk distributions, dependency assumptions, modeling capability, and integration with planning, none of which can be acquired cheaply. Second, verification by outsiders is weak because the statutory audit under IDW PS 340 does not extend to the Section 1 StaRUG requirements at all (Section 2.2); the practice is mandated but not inspected. Third, the signaling element is nearly costless: a firm can state in its risk report that it monitors existence-threatening developments and would initiate appropriate countermeasures without possessing any quantitative basis for determining when that point is reached.

This framing yields expectations that the data can bear on. If firms were substantively implementing the new requirements, the criteria should score together, because they form a dependency chain (Section 3.2): aggregation supports the risk-bearing-capacity concept, which supports a quantified threshold, which is what makes countermeasures and supervisory board notification triggerable at a defined point. If instead firms are conforming ceremonially, the pattern should be the reverse of the dependency structure: high scores on the visible, assertible, downstream criteria and low scores on the costly, technical, upstream ones. The two accounts make opposite predictions about the shape of the results, and Section 4 is read against that contrast in Section 5.

Framing the study this way also clarifies what the disclosure-based instrument measures and why that is the appropriate measure here. If the object of interest were the internal existence of a risk management technique, reading annual reports would be a weak proxy. But if the object of interest is whether a regulatory mandate has been substantively absorbed or ceremonially accommodated, then what a firm says in the statutorily mandated channel is not a proxy for the phenomenon: it is part of the phenomenon. A firm that has built the apparatus and does not report it has still not communicated its risk situation to the addressees the legislation names.

3. Materials and Methods

3.1. Data

This study analyses the 2021 annual reports of 83 companies listed in the DAX and MDAX, excluding those from the banking, stock exchange, and insurance sectors. The entire annual report was examined in each case, with particular attention to the risk report. Each report was scored against eleven criteria on a 0–2 scale, set out in Section 3.2, from which compliance with StaRUG and FISG can be estimated. The scoring and analysis were performed by the author and originally published in German in:

Jungesblut, C. (2024). Risikomanagement-Praxis deutscher DAX- und MDAX-Unternehmen nach StaRUG und FISG. Corporate Finance, 15(11–12), 274–280.

The present article draws on the same hand-coded disclosure dataset, supplemented by newly collected financial data, and is substantially extended beyond that original. The conclusions drawn from the analysis measure disclosed risk management practice: what a company states, in its own public reporting, about how it identifies, quantifies, aggregates, and acts upon risk. The instrument reads annual reports, not internal processes, and the construct is defined accordingly throughout this paper. Disclosure and implementation are related but not identical, and the relationship runs in one direction only: a firm may implement a practice without describing it, but it is unlikely to describe a practice in a statutorily relevant document without implementing it. The scores are therefore a lower bound on practice and are interpreted as such. Two considerations support treating that bound as informative rather than merely conservative. First, an earlier study (Köhlbrandt et al., 2020) made follow-up inquiries with companies and found that the risk management situation presented in the annual report corresponded to the actual situation. Second, and independently of that correspondence, the risk report is itself the statutorily mandated channel through which the risk situation is communicated to shareholders (Section 289 HGB); silence in that channel about the apparatus required by Section 1 StaRUG is a finding about governance communication whether or not the apparatus exists internally.

3.2. The Scoring Instrument

The instrument consists of eleven criteria, each scored on a three-point scale. The scale is anchored as follows: A score of 0 means the annual report gives no indication that the practice is in place (a “clear no”). A score of 1 means the report mentions or gestures at the practice but without enough detail to confirm that it is implemented in a methodologically sound way (a partial or ambiguous case). A score of 2 means the report states or demonstrates the practice clearly (a “clear yes”). For the criteria framed as a simple naming test, whether StaRUG, FISG, or DIIR Standard No. 2.1 is mentioned, only 0 and 2 are used, since a law is either named or it is not.

Each report was coded by the author against all eleven criteria, with the whole report in view and particular attention to the risk report. The maximum attainable score is 2.0 per criterion; the criterion average across the sample is the figure reported in Section 4. All eighty-three reports were coded by a single researcher. This is a limitation of the design, and no inter-rater reliability coefficient can be reported for the results presented here.

The criteria were not derived ad hoc. Each operationalizes a requirement stated independently in at least one established framework, and most appear in more than one: the COSO ERM Framework (COSO, 2017), DIIR Audit Standard No. 2.1 (DIIR & RMA Working Group, 2022), and recent statements of the methodological requirements of decision-oriented risk management (Rieg et al., 2025; Hunziker, 2025). Table 1 sets out that mapping.

Table 1. Mapping of the eleven criteria to independently stated framework requirements.

Source(s)	Requirement Operationalized	Criterion	#
DIIR No. 2.1; COSO ERM (governance and culture)	Adaptation of the risk management system to changed legal requirements	Changes to risk management in response to StaRUG/FISG	1
COSO ERM (strategy and objective-setting); DIIR No. 2.1	Risk appetite and tolerance defined, approved, and used as an escalation trigger	Defined threshold for the degree of existential threat	2
COSO ERM (information, communication, reporting); § 107 AktG	Information, communication, and reporting on risk to the oversight body	Changes in direct risk communication to the supervisory board	3
DIIR No. 2.1; § 1 StaRUG	Group-wide application of the risk management system	Specific risk-detection measures for German subsidiaries	4
-	Awareness of the applicable regulatory framework (no framework equivalent; compliance indicator)	Explicit mention of FISG	5
COSO ERM (information, communication, reporting); DIIR No. 2.1; Sheedy and Griffin (2018)	Independence of the risk reporting line from the executive board	Direct communication channel from risk management to the supervisory board	6
-	Awareness of the applicable regulatory framework (no framework equivalent; compliance indicator)	Explicit mention of StaRUG	7
DIIR No. 2.1; Rieg et al. (2025); Grisar and Meyer (2015)	Aggregation of quantified risks with reference to corporate planning to determine the total risk scope	Adequate risk aggregation methods (Monte Carlo simulation)	8
DIIR No. 2.1; Hunziker (2025)	Derivation of the equity and liquidity requirement from the aggregated total risk scope	Risk-bearing-capacity concept	9
COSO ERM (performance); Matschke and Brösel (2021)	Probability of insolvency or comparable measure of existential threat, used as a decision criterion	Quantifiable metric and threshold for risk-bearing capacity	10
-	Awareness of the audit standard covering the StaRUG and FISG requirements (compliance indicator)	Mention of DIIR Standard No. 2.1	11

The mapping is the instrument’s content validity argument: the criteria render observable a set of requirements that were formulated elsewhere, by other authors, and for other purposes than this study. Two features of it should be read together with the results. First, where the frameworks converge, on quantification, on planning-based aggregation, and on the translation of aggregate risk into a valuation parameter, the corresponding criteria (6, 8, 9, and 10) carry most of the analytical weight, and it is these that the discussion in Section 5 principally relies on. Second, three criteria (5, 7, and 11) are simple naming tests with no framework equivalent; they indicate awareness of the regulatory position rather than the presence of a practice, and no claim about capability is derived from them. Their inclusion is what allows awareness and capability to be distinguished in the results rather than conflated.

The eleven criteria are not independent. They form a dependency chain that mirrors the logic of decision-oriented risk management. Risk aggregation (criterion 8) is the precondition for a risk-bearing-capacity concept (criterion 9), which, in turn, is the precondition for a quantified threshold of existential threat (criteria 2 and 10), which is what allows “appropriate countermeasures” and supervisory board information to be triggered at a defined point (criteria 2, 3, and 6). A high score on a downstream criterion is only meaningful if the upstream criteria are also satisfied. This dependency is what makes the headline averages, taken criterion by criterion, easy to over-read, a point developed in Section 4.1.

3.3. Assessment Criteria

The risk reports were assessed against the following eleven criteria. Each criterion captures a particular aspect of decision-oriented, value-relevant risk management.

• Changes in response to StaRUG and FISG. Are changes to risk management described as a direct response to StaRUG and FISG? This examines whether companies proactively updated their practices in response to the new laws.
• Defined threshold for the degree of existential threat. Is there a defined threshold for the degree of existential threat above which “appropriate countermeasures” are initiated, as required by Section 1 StaRUG?
• Changes in direct risk communication to the supervisory board. Are there changes in the direct communication of risks to the supervisory board? Effective risk management includes transparent communication of risks to the supervisory board, enabling well-founded decision making.
• Specific measures for German subsidiaries. Are specific measures for risk early detection in German subsidiaries named, given that Section 1 StaRUG also applies to subsidiaries of a group?
• Explicit mention of FISG. Is the FISG mentioned by name, indicating awareness and acknowledgement of the legal framework?
• Direct communication from risk management to the supervisory board. Is there a direct communication channel from risk management to the supervisory board, facilitating the exchange of material risk-related information (Section 107 AktG)?
• Explicit mention of StaRUG. Is StaRUG mentioned by name in the risk management context (Section 1 StaRUG)?
• Adequate risk aggregation methods (Monte Carlo simulation). Are adequate methods of risk aggregation, such as Monte Carlo simulation, applied? A high score suggests that the company uses sophisticated methods to assess and aggregate risks (Vanini & Rieg, 2021).
• Risk-bearing-capacity concept. Is there a risk-bearing-capacity concept? Such a concept serves to assess the degree of existential threat (e.g., through a metric such as the probability of existential threat) (Gleißner et al., 2023a).
• Metric and threshold for risk-bearing capacity. Is there a quantifiable metric and a threshold for risk-bearing capacity? A high score suggests the company uses clear benchmarks to evaluate its risk-bearing capacity.
• Mention of DIIR Standard No. 2.1. Is DIIR Audit Standard No. 2.1 (2022) mentioned? Unlike IDW PS 340, DIIR Standard No. 2.1 captures the risk management requirements arising from StaRUG and FISG and shows how the corresponding requirements are to be examined by internal audit.

3.4. Explanatory Variables and Model Specification

The criterion scores describe how far disclosed practice has developed; they do not indicate why firms differ from one another. To address that question, five firm characteristics were collected for each of the 83 companies and related to the scores by ordinary least squares regression with heteroskedasticity-robust standard errors.

Size is measured as the natural logarithm of total assets. Larger firms command more resources for a risk function and attract greater external scrutiny, so a positive association is expected. Index membership is a dummy equal to one for DAX firms, which tests whether the null result reported in Section 4.2 survives the inclusion of other characteristics. Leverage is total debt divided by total assets, defined as interest-bearing financial liabilities; where a report presents IFRS 16 lease liabilities as a separate balance-sheet line, these are excluded, and where they are subsumed within the financial-liabilities line, they are retained, the treatment being applied consistently across the sample. Sector is controlled for by dummies for five macro-sectors (manufacturing and industrials; chemicals and pharmaceuticals; technology and software; real estate and holding companies; services, utilities, and transport), chemicals serving as the reference category; the granular sector labels attaching to individual firms are too numerous for the sample size to support.

Leverage carries particular theoretical weight here. The requirements of Section 1 StaRUG turn on the probability that risks in combination breach a covenant, trigger a rating downgrade, or lead to illiquidity. For a highly levered firm, these are live operational concerns; for a firm with little debt, they are remote. If the quantitative apparatus is being built where it has practical value rather than where it is nominally required, leverage should predict the substantive criteria.

Two further variables were considered and not used. The identity of the statutory auditor was collected in order to test the argument advanced in Section 2.2, on the reasoning that audit-led diffusion would make firms sharing an auditor converge on similar disclosure. It cannot serve that purpose here: 97.6 percent of the sample is audited by one of the four largest firms, leaving two observations outside that category and no variation for a coefficient to identify. The descriptive fact makes the point more directly than an estimate would have done, since firms that overwhelmingly share auditors do not share risk management practice. Profitability was not collected, its expected sign being ambiguous in any case: profitability supplies slack resources but also reduces the salience of insolvency risk.

Three dependent variables are used. The first is the overall index, the mean score across all eleven criteria. The second is a substantive subindex, the mean of criteria 8, 9, and 10, risk aggregation, the risk-bearing-capacity concept, and its quantified metric and threshold, which together constitute the apparatus that is costly to build and difficult for an outsider to verify. The third is an awareness subindex, the mean of criteria 5, 7, and 11, which are naming tests: whether FISG, StaRUG, and DIIR Standard No. 2.1 are mentioned at all. Naming a statute is very nearly costless; building the apparatus is not.

Estimating the same specification on both subindices gives a direct test of the competing expectations set out in Section 2.3. If firms are implementing the requirements substantively, the same characteristics should predict both subindices because awareness and capability would advance together. If firms are conforming ceremonially, the two should have different determinants: awareness responding to visibility and external scrutiny and capability responding to whether the firm has a material reason to possess it. Four companies are excluded from the estimation sample. For three of them, the report available was the single-entity HGB Jahresabschluss rather than the consolidated IFRS statements, and for one, the report covered the parent group rather than the listed entity; in each case, the balance sheet is not comparable with the rest of the sample. The estimation sample is therefore 79 firms. The analysis is exploratory, the estimates are associational rather than causal, and effects of modest size may go undetected: at this sample size, the design has adequate power only for effects explaining upwards of roughly a tenth of the variance.

4. Results

The analysis of the 83 annual reports against the eleven criteria, with scores from 0 to 2 points, yielded an overall average of 0.73 points, approximately 37% of the maximum possible score (Table 2).

Table 2. Average scores per criterion (0–2 scale), sorted ascending.

Average Score	Question (Abbreviated)	Criterion
0.00	Specific risk-detection measures named for German subsidiaries?	4
0.00	Is StaRUG mentioned by name?	7
0.02	Is DIIR Standard No. 2(.1) mentioned?	11
0.20	Changes in direct risk communication to the supervisory board?	3
0.43	Changes to risk management described as a response to StaRUG/FISG?	1
0.63	Is FISG mentioned by name?	5
0.99	Adequate risk aggregation methods applied (Monte Carlo)?	8
1.02	Metric and threshold for risk-bearing capacity?	10
1.27	Risk-bearing-capacity concept present?	9
1.64	Appropriate countermeasures initiated above a threat threshold?	2
1.84	Direct communication from risk management to supervisory board?	6

4.1. Analysis by Criterion

The average scores per criterion show where the gaps are largest. They differ widely.

The requirements under Section 1 StaRUG are not reflected in reporting practice at all. StaRUG is not mentioned by a single company. The implementation of the StaRUG requirements in subsidiaries, which are usually also limited-liability companies and therefore covered by Section 1 StaRUG, is likewise not mentioned in any annual report. Correspondingly, DIIR Standard No. 2, which, since 2022, reflects the Section 1 StaRUG requirements, is named by exactly one company. The FISG is at least mentioned by 26 companies (score 0.63), although it, like Section 1 StaRUG, would be relevant for all companies. Taken together, a development of risk management oriented directly toward the expanded requirements of StaRUG and FISG is unambiguously evident in only 3 out of 83 companies (score 0.43).

An intermediate level is found for the application of risk aggregation methods (Monte Carlo simulation, criterion 8), at 0.99 points. The implementation of risk-bearing-capacity concepts, which should build on risk aggregation, is similarly mid-ranked (1.27 points for criterion 9 and 1.02 for criterion 10). Risk aggregation is a precondition for assessing the degree of existential threat, and the risk-bearing-capacity concept is required because it supplies the metric for that degree.

A relatively high 62 out of 83 companies state that appropriate countermeasures would be initiated in the event of a critical existential threat (1.64 points). On closer reading of the explanations in the annual reports, however, this positive statement must be qualified. Owing to the absence of risk aggregation and risk-bearing-capacity measurement, many companies that intend to initiate countermeasures cannot adequately judge when appropriate countermeasures within the meaning of Section 1 StaRUG become necessary. Moreover, the annual reports gave no indication that, in line with Section 1 StaRUG, the supervisory board had defined a concrete threshold for the (measurable) degree of existential threat above which the “appropriate countermeasures”, as well as the immediate self-information of the supervisory body, would have to follow.

Criterion 6 is assessed most favorably: for the great majority of companies, direct communication between risk management and the supervisory board is now provided for.

One pattern concerns the use of Monte Carlo simulation. Alongside the 20 companies whose annual reports clearly indicated the use of Monte Carlo simulation for risk aggregation and risk management, a further 17 companies stated that they do not use such simulations in risk management but do use them for other purposes, such as the valuation of share-based compensation. These companies thus appear to possess both the know-how and the technical prerequisites to perform Monte Carlo simulations yet do not deploy them to meet the statutory requirements for risk management. The gap is therefore not one of capability but of application: the method is present in the firm and is not directed at the risk management task for which Section 1 StaRUG creates the requirement (Gleißner et al., 2023b). This dissociation between available technique and its non-deployment in the regulated domain is taken up in Section 5.

4.2. Index

DAX companies achieved a slightly higher average score than MDAX companies (0.784 versus 0.692 points). This difference is not statistically significant (t = 1.495, p = 0.1393). Because the index is a bounded ordinal measure rather than a continuous one, a Mann–Whitney U test is the more appropriate procedure; it returns U = 1026 with p = 0.087, which is likewise not significant at conventional levels, though closer to the 10 percent boundary than the t-test. Both tests are reported because they do not point in quite the same direction, and reporting only the more convenient of the two would misrepresent the strength of the evidence. Index membership is therefore not associated with the extent of disclosed decision-oriented risk management at the 5 percent level. Given the sample size (n = 83), this should not be read as evidence that DAX and MDAX firms are equivalent, only that no difference can be established from these data. The group means are shown in Figure 1.

Figure 1. Average score by index.

4.3. Sector

The following sector ranking is restricted to sectors with three or more companies to avoid the possible identification of specific firms. Automobile production showed the highest average, 0.977, and medical technology the lowest, 0.500 (Table 3).

Table 3. Average score by sector for sectors with three or more companies.

Average Score	Sector (≥3 Companies)
0.977	Automobile production
0.818	Telecommunications
0.773	Media
0.727	Software
0.701	Real estate
0.659	Chemicals
0.500	Medical technology

4.4. Top Ten Companies

Among the companies examined, Ströer SE & Co. KGaA and adidas AG had the highest average, 1.364. The remaining companies in the top ten were BMW, GEA Group AG, Henkel, Mercedes-Benz Group, Continental, Delivery Hero SE, Vonovia, and Dürr AG. No company came near the maximum of 2.0 (Table 4).

Table 4. The ten highest-scoring companies.

Average Score	Company	Rank
1.364	Ströer SE & Co. KGaA	1
1.364	adidas AG	1
1.182	BMW	3
1.182	GEA Group AG	3
1.182	Henkel	3
1.182	Mercedes-Benz Group	3
1.091	Continental	7
1.091	Delivery Hero SE	7
1.091	Vonovia	7
1.091	Dürr AG	7

4.5. Firm Characteristics and the Extent of Disclosure

Table 5 reports ordinary least squares estimates for the three dependent variables defined in Section 3.4, with heteroskedasticity-robust standard errors in parentheses.

Table 5. Firm characteristics and the extent of disclosed risk management practice.

(3) Awareness Subindex	(2) Substantive Subindex	(1) Overall Index
0.009 (0.034)	0.131 * (0.069)	0.029 (0.027)	ln(total assets)
0.020 (0.108)	−0.020 (0.184)	0.032 (0.070)	DAX membership (1 = DAX)
0.040 (0.284)	0.081 (0.583)	0.149 (0.254)	Leverage (total debt/total assets)
Yes	Yes	Yes	Sector fixed effects
0.957	0.071	0.542	Model F-test, p-value
0.101 (0.294)	−0.289 (0.586)	0.389 * (0.230)	Constant
79	79	79	Observations
0.030	0.137	0.061	R2

OLS regressions of the overall index and its two subindeces on firm characteristings. Standard errors in parentheses. Sector fixed effects in cluded in all models. n = 79. * p < 0.10.

Model 1 relates the overall index to the firm characteristics. No coefficient approaches conventional significance, the sector dummies are jointly indistinguishable from zero (joint F-test on the sector terms, p = 0.798), and the model as a whole is not significant (model F-test, p = 0.542), with an R² of 0.061. On the evidence of these variables, how far a company has developed its disclosed risk management is not a function of how large it is, which index it belongs to, how indebted it is, or what it makes.

Disaggregating the index changes that picture in one specific respect. In Model 3, which takes the awareness subindex as the dependent variable, nothing predicts anything: the R² is 0.030, and the model’s p-value is 0.957, about as complete a null as a specification of this kind can produce. Whether a company names StaRUG, FISG, or DIIR Standard No. 2.1 in its annual report is unrelated to every firm characteristic examined here. In Model 2, by contrast, which takes the substantive subindex—risk aggregation, the risk-bearing-capacity concept, and its quantified metric and threshold,—size carries a positive coefficient of 0.131 that is significant at the 10 percent level (p = 0.056), and the model is jointly significant at that level (p = 0.071), with an R² of 0.137. Across the interquartile range of the sample, from roughly €4.3 billion to €42.5 billion in total assets, the estimate implies a rise of about 0.30 points on the 0–2 scale, against a subindex mean of 1.11.

Two qualifications are essential to reading that result. First, the size coefficient is not robust to the specification: estimated without the sector controls it falls to p = 0.116, and on criterion 8 alone, risk aggregation, the single most consequential criterion, it reaches only p = 0.104. An effect that moves across the conventional threshold depending on which controls are included should be read as suggestive and not as established. Second, the formal comparison of the size coefficients across Models 2 and 3, which is the direct test of the competing expectations set out in Section 2.3, does not reach significance either (z = 1.60, p = 0.111). What the models support is therefore a pattern rather than a finding: the costly quantitative apparatus is somewhat more prevalent among larger firms, whereas naming the statute is unrelated to anything observable, and the two behave differently enough that treating the index as a single construct obscures more than it reveals.

Leverage deserves separate comment because Section 3.4 identified it as the theoretically loaded variable. The obligations of Section 1 StaRUG turn on the probability that risks in combination breach a covenant, trigger a rating downgrade, or lead to illiquidity, and those are live concerns for a highly indebted firm and remote ones otherwise. If the apparatus were being built where it has practical value, leverage should predict the substantive criteria. It does not, in any specification: the coefficient is 0.081 with a standard error of 0.583. Firms with the most immediate economic reason to be able to measure their own degree of existential threat are no more likely to disclose the means of doing so than firms with almost no debt. Read alongside the auditor concentration reported in Section 3.4, the picture is one in which the extent of disclosed practice tracks neither economic need nor audit exposure, which is what the decoupling account anticipates and what a substantive-adoption account does not.

5. Discussion, Interpretation, and Limitations

Overall, disclosed risk management practice is thin: the sample average of 0.73 is approximately 37% of the maximum attainable score, and the DAX and MDAX subsamples (0.784 and 0.692) do not differ significantly. The analysis is therefore consistent with the legal obligations associated with StaRUG and FISG not having been substantively implemented or, at a minimum, not having been communicated by German listed companies in 2021. On the evidence of public reporting, the improvement in risk management intended by StaRUG and FISG had not yet materialized in the first reporting year after the legislation entered into force.

FISG is mentioned by only 31.3% of companies, and StaRUG by none of the DAX and MDAX companies in connection with risk management. This is concerning given that Section 1 StaRUG markedly raised the requirements for risk management. Unlike the older KonTraG, the law now requires continuous monitoring of the degree of existential threat and, where needed, the initiation of appropriate countermeasures or the information of the supervisory board. Starting from risk aggregation and a risk-bearing-capacity concept, the supervisory board should set thresholds above which the initiation of countermeasures and the (immediate) information of the supervisory board would have to begin. Most of this is not to be found in the bulk of the annual reports. Even at DAX and MDAX companies, then, the implications of StaRUG and FISG are, on the evidence of public reporting, not yet visible.

It is worth being explicit about what this adds to the normative literature. Statements of what decision-oriented risk management requires are by now well developed. They characterize prevailing practice as marked by absent aggregation or reliance on expected loss values, by routine risk reporting rather than decision support, and by risk management organized in a functional silo. That characterization is offered as a perspective rather than as a measurement, and the same holds for the corresponding statements in COSO ERM (COSO, 2017), in DIIR Standard No. 2.1, and in the textbook literature (Rieg et al., 2025; Hunziker, 2025).

The division of labor between that literature and the present study is accordingly straightforward: the normative sources establish the benchmark, and the data reported here measure the distance to it in the population where the requirements are legally binding and where the capacity to comply is least in doubt. That the DAX and MDAX firms examined disclose, on average, roughly 37 percent of the benchmark is informative precisely because these are the firms facing the fewest resource constraints, with the largest finance functions and the most extensive audit relationships. Whatever the position in the Mittelstand, to which Section 1 StaRUG applies equally, there is little reason to expect it to be better; the survey evidence available for smaller German companies points the other way (Ulrich, 2019; Rieg & Vanini, 2021).

5.1. From Risk Analysis to Risk Aggregation to Simulation-Based Valuation

The decision-oriented relevance of these findings goes beyond formal compliance. The eleven criteria are not a compliance checklist sitting beside the valuation problem; each maps onto a specific input of a simulation-based valuation, so a low score is also a statement about what a firm cannot value. That mapping is the part of the picture the compliance reading leaves out.

Simulation-based valuation proceeds in three linked steps: a plan of future cash flows, a quantification and aggregation of the risks around that plan, and a translation of the aggregate risk into the parameters that drive value, above all the cost of capital and the probability of insolvency (Berry-Stölzle & Xu, 2018). The instrument’s criteria attach to each step.

The chain does not end at the valuation figure. What makes risk management decision-oriented rather than merely quantitative is that the aggregated risk position is condensed into a performance measure against which alternative courses of action can be compared, so that return and risk are weighed against one another in a single figure instead of being assessed in parallel and reconciled by judgement. In the value-based tradition, that measure is the decision value (Entscheidungswert): the value of a course of action to the particular decision maker, given that decision maker’s own aggregated risk position, financing constraints, and degree of diversification (Matschke & Brösel, 2021; Ernst & Kamarás, 2023; Rieg et al., 2025).

Its defining property is that it is computed from the firm’s own aggregated risk rather than from a market-implied proxy, which is why two firms facing the same project may value it differently and both be correct. This is also what connects the apparatus to Section 93 AktG. The Business Judgement Rule requires that an entrepreneurial decision rest on adequate information about its consequences; where those consequences are uncertain, a measure that combines expected return with the decision’s effect on the firm’s aggregate risk position is what “adequate information” amounts to in operational terms. The criteria examined here are therefore not an accessory to the valuation problem. They are the mechanism by which a decision becomes assessable at all, and their absence is the reason a firm may satisfy the formal requirements of risk reporting while remaining unable to say what any given decision is worth to it.

Risk aggregation by Monte Carlo simulation (criterion 8) is the step that produces the distribution of results around the plan, rather than a single expected value. Without it, a firm has point estimates but no spread and therefore no way to say how likely a covenant breach, a rating downgrade, or insolvency is. The sample average of 0.99 means that step is, at best, half-built across listed Germany. A risk-bearing-capacity concept (criterion 9, average 1.27) and a quantified metric and threshold for it (criterion 10, average 1.02) are the steps that convert the aggregated distribution into a usable figure: the probability of existential threat, which is also the firm’s own contribution to its cost of capital and to its credit spread. A firm that scores low here cannot derive its cost of capital from its risk position; it can only borrow one from a peer group or a CAPM beta that reflects the market’s guess rather than its own plan. The threshold criteria (2 and 10) are the steps that make the resulting figure actionable as the point at which the supervisory board is told and countermeasures begin. A high score on the “countermeasures” criterion (2, average 1.64) without the upstream aggregation and threshold (8, 9, and 10) is exactly the pattern the data show, and it is hollow: a firm that will act “when the threat is critical” but cannot measure the degree of threat has named a trigger it cannot read.

This capability deficit has a visible counterpart in what German listed companies report as their cost of capital. Frey and Heilmann (2026a) document that the weighted average cost of capital disclosed by DAX40 companies remained within a band of roughly 7 to 8 percent, while the yield on ten-year German government bonds fell from 4.1 percent to −0.2 percent. Testing five candidate explanations drawn from capital market and fundamental data, systematic risk, overall market volatility, the market price of risk, earnings risk, and financial structure risk, they find that none accounts for the persistence and conclude that market-based parameters reach their explanatory limits at this point. A companion study turns to interview evidence for the explanation the quantitative route could not supply (Frey & Heilmann, 2026b).

The findings reported here suggest a supply-side mechanism worth considering alongside that evidence. A firm that does not aggregate its risks over its corporate plan has no route from its own risk position to its own cost of capital and must instead import a discount rate from a peer group, from a CAPM beta, or from a rate carried forward through successive planning rounds. An imported rate has no mechanism by which to respond either to a change in the firm’s risk position or to a change in the risk-free rate because neither quantity enters its derivation. Capital costs that remain stable while their underlying parameters do not are what one would expect to observe if the derivation were largely absent. On the criteria measured here, that absence is widespread: risk aggregation scores 0.99 and a quantified metric and threshold for risk-bearing capacity 1.02, on a scale where 2.0 denotes a clearly disclosed practice.

This is a conjecture consistent with both sets of results rather than a demonstrated link, and it should be read with the differences between the two designs in view. Frey and Heilmann examine DAX40 firms over a two-decade window; the present sample covers DAX and MDAX firms excluding financial institutions in the single reporting year 2021, and no firm-level matching between the two datasets has been attempted. What the juxtaposition does establish is that the question is answerable. A design that matched disclosed risk aggregation capability against the sensitivity of a firm’s disclosed cost of capital to movements in the risk-free rate would test the mechanism directly, and both of the measures such a design would require already exist in the published literature. This is, in the view taken here, the most productive extension of the present study, and it is one that the compliance reading of these data would not have suggested.

Read this way, the headline finding is not that firms are out of compliance but that the typical listed German company lacks the apparatus to value its own decisions in the way the Business Judgement Rule (Section 93 AktG) presumes. Section 93 requires that an entrepreneurial decision rest on adequate information about its consequences, and for an uncertain decision, that means its consequences for the firm’s risk position. The same aggregation that criterion 8 looks for is what would let a board show the value and risk effect of an acquisition, a capacity expansion, or a financing choice before taking it. The widespread absence of that aggregation is therefore a deficit not in reporting but in the capability that decision-oriented valuation depends on. The criteria, in other words, double as a valuation-readiness diagnostic: the score measures how much of a firm’s own value-and-risk machinery is actually in place.

5.2. Implications for Audit and Governance

The likely explanation for the slow uptake lies in the absence of these requirements from the statutory audit. Unlike DIIR Standard No. 2.1 (2022), which reflects StaRUG, the older IDW PS 340 continues to address only the requirements of Section 91(2) AktG. The StaRUG requirements are examined only when there is an occasion to do so (a loss event). The “unbureaucratic” solution that this represents—understandable in view of the obligation also falling on mid-sized corporations—has unwelcome consequences. It would have been sensible to make the implications of Section 1 StaRUG, Section 91(3) AktG, and Section 93 AktG for risk management at least the subject of the audit for large corporations or listed stock corporations.

On the premise that the methods actually used in risk assessment are described in the annual reports, this study is consistent with the concern, voiced in the practitioner literature, that companies’ capabilities in dealing with opportunities and risks are underdeveloped relative to what the statutory minimum requires. The data do not permit a claim about why. One reading consistent with the pattern is that attention follows audit scope: the practices that are examined under IDW PS 340 are reported, and those that are not examined are not. This is an interpretation of an association, not an inference about managerial intent, and it is offered as a hypothesis for research designs capable of testing it, an interview or survey evidence on how risk management priorities are set, rather than as a finding of this study.

There is a substantial need for action. The supervisory boards are particularly called upon: they are directly addressed in Section 1 StaRUG and Section 107 AktG and may incur personal liability if the requirements of Section 1 StaRUG are not implemented.

5.3. Limitations and Future Research

Several limitations should be noted. First, the study relies on the disclosure premise, that the methods actually used are those described in the annual report. While this premise is supported by follow-up inquiries in a prior study, undisclosed practice cannot be ruled out, and the scores should be read as a lower bound on actual sophistication. Second, banks, exchanges, and insurers were excluded because they are subject to separate sectoral regimes, which limits generalization to the wider economy. Third, the analysis captures the 2021 reporting year, immediately after StaRUG and FISG entered into force, and therefore measures early, rather than steady-state, implementation. Because the focus here was on the speed of implementation directly after the 2021 entry into force, future research will analyze current annual reports using the same procedure and contrast the results with those of this study, allowing the trajectory of adoption to be traced over time.

Fourth, the eleven criteria are weighted equally in the index, and no claim is made that they are equally important. A defensible case could be made for weighting risk aggregation (criterion 8) and the risk-bearing-capacity concept (criterion 9) more heavily than the naming criteria (5, 7, and 11), on the grounds that the former are substantive capabilities and the latter are indicators of awareness. Equal weighting was retained because any alternative weighting would require a justification the literature does not currently supply and because the criterion-level results are reported in full (Table 2) so that readers may apply their own weights. The dependency structure set out in Section 3.2 is the reason the index mean should not be read on its own, and the criterion-by-criterion analysis in Section 4.1 is the primary result.

Fifth, the study is cross-sectional, and its associations are not causal. The regression results in Section 4.5 identify firm characteristics that covary with the extent of disclosure; they do not establish that any of these characteristics produce it, and unobserved heterogeneity, in particular differences in the resourcing and seniority of the risk function, which annual reports do not reveal, is likely to be substantial. With n = 79, the analysis is also underpowered for detecting modest effects, and null coefficients should be read accordingly.

Sixth, all coding was performed by a single researcher, and no inter-rater reliability coefficient can be reported. Independent coding by a second researcher would be required to establish the reliability of the instrument, and the results should be read with this constraint in view.