How Kredsløb strengthened its shared risk management

Challenge

CER, NIS2 and increasing resilience requirements created a need for a shared approach to risk management across operations, projects and business functions.

Solution

Kredsløb updated its risk management framework with shared policies, risk matrices and an inherent risk list for the utility sector.

Result

A common foundation for risk management that supports consistent assessments, an accurate view of risk and better decision-making.

Danish utility Kredsløb wanted to strengthen its shared approach to risk management across the group. It now has a common foundation that supports consistent risk assessments and a stronger basis for decision-making.

As one of Denmark’s largest municipally owned utilities, Kredsløb provides critical heating, energy, waste and recycling services to Aarhus Municipality and parts of East Jutland.

An escalating threat landscape and stricter legal requirements, including CER (resilience of critical infrastructure) and NIS2 (cybersecurity and the handling of significant incidents), created a need to further develop the group’s governance framework. The aim was to establish a stronger common foundation for resilience, preparedness and risk management across the organisation.

At the same time, Kredsløb wanted to strengthen its shared approach to risk management enabling management, project teams and operational functions to share a common understanding of risk and providing a stronger basis for prioritisation, development and decision-making across the group.

A holistic framework for risk management

Kredsløb decided to develop its overall governance framework further through a cross-functional programme. Based on legal requirements, the programme aimed to ensure a holistic approach that adds value across the group, including in risk management.

“Risk management shouldn’t just help us meet requirements. First and foremost, it should help us make informed decisions about running and developing the business,” explains Oliver Takacs Sørensen, Compliance & Risk Management Specialist at Kredsløb.

The foundation: group policy, method and principles

Kredsløb ran the programme using in-house resources and brought in Force Technology as an independent expert adviser to help further develop the group’s risk management framework, with a particular focus on industrial facilities.

The work included:

Further developing the group’s risk management policy
Updating the group-wide risk matrix for operations and projects
Establishing common principles for risk assessment
Developing an inherent risk list tailored to the utility sector
Pilot testing of risk screening as a method.

The aim was to create a foundation that can be used in day-to-day operations while also supporting the continued development of the organisation’s overall governance and resilience work.

Risk management rooted in the utility’s core mission

An important part of the work was linking the organisation’s activities, the associated risks and the decisions that need to be made.

The method is based on processes that are critical to service delivery and the assets and suppliers that support them, so that risk management focuses on the factors that could affect the organisation’s ability to deliver critical services. This anchors risk management in the utility’s core mission, while compliance is supported as a natural outcome of a systematic approach to risk and resilience management. The shared methodology links operational, tactical and strategic risks.

“Put simply, it was about looking at our own organisation and identifying our most critical assets so we could prioritise our risk management efforts,” says Oliver Takacs Sørensen.

A common foundation and value-adding risk management

The collaboration has helped give Kredsløb a common foundation that the organisation can build on. With a consistent method and a common language, risks can be assessed and prioritised across business areas and organisational levels. This makes it possible to use risk management actively as a basis for decisions, priorities and continuous improvement.

The work therefore not only supports compliance but also contributes to safety, security and more resilient service delivery.

“We’re in a much better place today. Risk management is now part of everyday work throughout the business and creates value across the organisation,” concludes Oliver Takacs Sørensen.

The green transition requires a robust energy system and clear risk management

The collaboration between Force Technology and Kredsløb took place under the performance contract “A robust and coherent energy system for a secure green transition”. The focus area covers energy storage and conversion technologies brought to market through testing, demonstration and development, as well as a coherent energy system with intelligent solutions and shared data.

As the energy system becomes more integrated, the interdependencies between assets, data and operations grow. This makes resilience of critical infrastructure a prerequisite for both security of supply and the green transition.