CPD Interview on Risk Culture with Horst Simon on RiskMasters

Q: Why is the Three Lines of Defense model outdated?

The Three Lines model focuses too much on defense and reporting rather than empowering employees with real risk management skills. Today's risks demand proactive thinking across all levels of an organization.

"Risk management is not about colors and matrices. It's about people." – Horst Simon

In this CPD-accredited episode of RiskMasters, host Julien Haye welcomes Horst Simon, veteran risk management expert and pioneer of people risk and risk culture. Drawing from decades of experience across Africa, Asia, Europe, and the Middle East, Horst shares his journey, his challenges to outdated risk practices, and his vision for the future of risk management.

As organisations face an unpredictable world shaped by interconnected threats and rapid change, Horst argues that the real competitive advantage lies not in more controls or more reports — but in empowering every employee to be a risk manager.

If you enjoyed this episode, don’t forget to like, follow, and leave a review! Your feedback helps us bring more thought-provoking insights from industry leaders.

In this edition of RiskMasters, you will learn:

🔹 Why Risk Culture Starts with People, Not Policies: Horst shares how true risk resilience depends on embedding risk thinking into every employee’s mindset — and why outdated models like the Three Lines of Defense miss this opportunity.

🔹 How to Rethink Leadership, Reporting, and Risk Strategy: Discover why boards must stop relying on sanitised historic reports, how to measure risk culture maturity meaningfully, and why leadership must move from control to empowerment.

🔹 The Future of Risk Management in an Unpredictable World: Explore the biggest emerging risks for 2025 — including cyber threats, social cohesion risks, and the misuse of AI — and how cross-cultural awareness and proactive risk intelligence will define future success.

More about Horst Simon:

Horst Simon is a recognised global expert in risk culture, operational risk, and people risk. With experience across continents and industries, Horst is the founder of Risk Culture Builders, a network dedicated to helping organisations embed effective, sustainable risk cultures. His non-conformist and practical approach challenges outdated thinking and redefines how organisations should approach risk in a fast-changing world.

📌 Connect with Horst Simon on LinkedIn for insights into risk culture, leadership, and future-proofing risk management.

🎙 Tune in now to learn how you can future-proof your organisation by embedding risk thinking into every layer of the business.

Listen to the full episode on your player of choice:

Discover related risk management topics:

Download your CPD Certificate:

Link: ⁠ https://thecpd.group/podcast/

Accreditation number: #800117

Recap Blog: Risk Culture and the Future of Risk Management with Horst Simon

"No war is ever won from the trenches. We must get out and lead." – Horst Simon

In this thought-provoking episode of the RiskMasters podcast, host Julien Haye speaks with Horst Simon, one of the earliest advocates for embedding risk thinking into people, culture, and leadership. They discuss why traditional risk management approaches are no longer fit for purpose and how organisations must evolve to survive in a complex, unpredictable world.

Why Traditional Risk Management Models Are Failing

Horst challenges conventional models like the Three Lines of Defence, arguing they create a false sense of security. Instead of focusing on endless controls, organisations should prioritise building risk skills at every level.

"Risk is not a department. It's every decision, every day, by everyone."

Embedding Risk Thinking into Culture

A strong risk culture is not a project — it’s an ongoing journey. Horst emphasises that leadership must stop treating risk culture like a one-off initiative. Organisations need to continuously assess, monitor, and live their risk culture every day.

Key strategies include:

Building partnerships between Risk and HR to embed risk into performance management.
Training employees to think and act like risk managers, not just ticking compliance boxes.
Ensuring strategy, risk appetite, and risk culture are fully aligned and transparent across all levels.

Technology’s Role: Tool, Not Replacement

Horst highlights that while AI can strengthen detection and analysis, it cannot replace human judgment and critical thinking. Risk culture building remains an inherently human endeavour — technology is an enabler, not a substitute.

Emerging Risks to Watch for in 2025

Horst identifies three critical emerging risks:

Outdated risk practices that no longer match the speed of change.
Cyber threats driven by growing interconnectivity and AI-driven attacks.
Erosion of social cohesion, impacting stability, trust, and operational resilience.

Actionable Takeaways from the Episode:

✔ Rethink and evolve outdated risk management frameworks.

✔ Invest in educating every employee on risk thinking.

✔ Shift leadership focus from controls to empowering smarter decision-making.

✔ Build and monitor a living, evolving risk culture.

✔ Embrace technology as a tool — but never outsource judgment.

Conclusion: The Future of Risk is Human

Horst Simon’s insights are a powerful reminder: the real strength of an organisation lies not in its controls, but in its people. In a world where change is constant, embedding critical thinking, adaptability, and shared responsibility for risk across the workforce will determine who survives — and who thrives.

FAQs: Building Risk Culture and Future-Proofing Risk Management

Why is the Three Lines of Defence model outdated?

The Three Lines model focuses too much on defence and reporting rather than empowering employees with real risk management skills. Today's risks demand proactive thinking across all levels of an organisation.

How can organisations measure risk culture maturity effectively?

A robust risk culture assessment should combine people insights with process evaluations. It must go beyond employee surveys and historic data, providing a clear picture of how culture supports or undermines risk management.

What are the biggest emerging risks organisations should watch for?

Horst Simon highlights three critical risks: outdated risk management practices, escalating cyber threats, and the erosion of social cohesion, all of which demand new resilience strategies.

What role does leadership play in building a strong risk culture?

Leadership must shift from policing compliance to empowering employees to think critically about risks. Boards must ask forward-looking questions rather than simply reviewing past performance.

How should organisations use AI in risk management?

AI should be treated as a tool to enhance risk detection and decision-making — but not as a replacement for human judgment, critical thinking, or cultural intelligence.

Why is cross-cultural awareness important in risk management?

Different worldviews — such as guilt/innocence, honor/shame, and power/fear — shape how individuals perceive and respond to risk. Understanding these differences is essential for building a resilient and inclusive risk culture.