Decision-Oriented Risk Management as a Legal Mandate: Evidence on Risk Aggregation, Risk-Bearing Capacity, and the Implementation of StaRUG and FISG in German DAX and MDAX Companies

The decision-oriented conception of enterprise risk management (ERM), in which risks are quantified, aggregated, and weighed against return when business decisions are prepared, is increasingly regarded as the core of value-based management. In Germany, this conception acquired a legal foundation in 2021: Section 1 of the Stabilization and Restructuring Framework for Enterprises Act (StaRUG), the Financial Market Integrity Strengthening Act (FISG), and the amended Section 91(3) of the German Stock Corporation Act (AktG) require continuous monitoring of developments that may jeopardize the company’s continued existence, the initiation of “appropriate countermeasures” once a critical threshold is exceeded, and direct communication of the risk situation to the supervisory board. This paper argues that these obligations are difficult to satisfy without risk aggregation by Monte Carlo simulation and a quantitative risk-bearing-capacity concept, the same apparatus that underpins simulation-based valuation. The study asks whether listed firms report using it. The 2021 annual reports of 83 DAX- and MDAX-listed companies (excluding banks, exchanges, and insurers) are scored against eleven criteria capturing disclosed risk management practice. Because the instrument reads public reporting rather than internal process, the scores are interpreted throughout as a lower bound on practice. The average score is 0.73 of a possible 2.0 (about 37%). StaRUG is named by no company; FISG is by roughly 31%; and only a minority disclose adequate risk aggregation or a risk-bearing-capacity concept with a defined threshold. The pattern, near-universal assertion of readiness to act, combined with near-absence of the quantitative apparatus that would make such action triggerable, is consistent with ceremonial conformity decoupled from substantive practice. The value-relevant core of risk management thus remains largely unreported. Because the same apparatus generates the cost of capital and the decision value used in simulation-based valuation, the scores also function as a diagnostic of valuation capability: a firm that cannot aggregate its risks must import a discount rate rather than derive one. This has implications for valuation, governance, supervisory oard liability, and audit.