Insight · Risk and internal control

The risk analysis is done every year. Leadership is still taken by surprise

Peter Öberg · 1 November 2026 · 3 min read

Every autumn, many boards and committees carry out a risk analysis. It becomes an internal control plan, the controls are performed and reported. And yet it is often something completely different that goes wrong. That says something about how the risk analysis is done.

The link between risk and control is weak

When auditors in Nacka, a Swedish municipality, reviewed internal control in 2019, they found weaknesses above all in the risk analysis work of the committees and executive board, and in the follow-up of internal control plans. The municipality's internal control regulations did not even cover risk analysis, follow-up or what the plan should contain. In Upplands Väsby, auditors recommended in 2026 that traceability from risk analysis to internal control plan be strengthened, and that the prioritisation of risks be better anchored with the board and committees.

That is the heart of the problem. If you cannot see why a particular control exists, it is hard to know whether you are checking the right things.

A typical example: year after year, the internal control plan includes checks on approvals, entertainment expenses and leasing contracts. Everything is checked and reported without remark. Meanwhile, the entire payroll depends on one person who has worked there for twenty years and is the only one who understands the system. When she goes on long-term sick leave, operations stand still for weeks. The risk was not hard to see. It simply never made it into the analysis, because the analysis started from last year's plan instead of asking what could actually knock the organisation out.

Why it happens

The risk analysis becomes an administrative exercise. It is done by an officer using a template, and the board approves it without really discussing it.

People choose what is easy to check. Approval routines and invoice samples are easy to follow up. That the service is not meeting its goals, or that one key person holds too much knowledge, is harder. So it does not get checked.

The same risks year after year. When the analysis is copied from last year, it misses what has changed.

A better way

1. Do the risk analysis with leadership, not for leadership. A short conversation where the leaders themselves point out what could go seriously wrong is worth more than a long template.
2. For every control, write down which risk it addresses. If you cannot, maybe the control is not needed.
3. Ask what has surprised you in the past year. Was it in last year's risk analysis? If not, why not?

A question for your next leadership meeting

Which of the things that went wrong for us in the past year were in last year's risk analysis?

Sources: Nacka municipality, audit report 6/2019 on internal control (Swedish) · Upplands Väsby municipality, audit report 2026:2 on internal control (Swedish)