201 Risk management to prevent endangerment.

In addition to describing the general responsibilities of corporate boards, Dutch corporate law also lays down specific board responsibilities, particularly related to compliance, risk management and due diligence.1 The responsibility for risk management requires boards to establish an internal risk management system capable of identifying strategic, operational, compliance and reporting risks related to the present and future performance of their corporation.2 A fifth category of societal or systemic risks is increasingly added to capture any risks related to larger systems such as the financial system or the planetary climate system.3 The monitoring and management of such systemic risks takes two forms.4 On the one hand, boards need to monitor and manage the risks caused by changes in larger systems to the continued performance of their corporation. On the other hand, boards need to monitor the risks caused by their corporation to the functioning of these larger systems.

Verdam importantly emphasized that this distinction has implications for the freedom of corporations to establish their own risk appetite in relation to the risks of change facing their corporation.5 In relation to risks threatening the future performance of their corporation, boards are free to determine their own risk appetite as part of their entrepreneurial freedom to pursue their own strategy for value creation (including the level of risk that they are willing to take in achieving this). However, in relation to risks posed by the corporation to the performance of larger systems, boards are not free to determine their own risk appetite but rather have a general legal duty to prevent disproportionate endangerment (gevaarzetting). In accordance with general liability law, anyone who creates a situation with the risk of illegally causing harm to a third person has a duty to take suitable preventive measures.6 In disposing of their duty to prevent disproportionate endangerment, boards are generally required to consider the gravity and probability of the harm in relation to the possibilities of taking preventive measures, including the risk management system itself, and the practical objections against taking such preventive measures.7 As such, boards are faced with the need to determine the legitimate level of systemic risk that they are allowed to create for their environment, thereby inviting discussion concerning the standards according to which they should determine their appetite for such a systemic risk. In my analysis, the shift from the freedom to determine their own risk appetite towards a duty to limit their appetite for systemic risks therefore creates a third issue in Dutch corporate law which merits further research.8