Stefan
Hunziker
Professor of Risk Management at Lucerne University of Applied Sciences and Arts. I study how organizations deal with uncertainty, and how risk management can strengthen both financial resilience and decision quality.
What I work on
Enterprise risk management
How ERM can move beyond stand-alone risk registers to support two distinct management tasks: strengthening financial resilience and improving consequential decisions under uncertainty.
Decision quality under uncertainty
How objectives, alternatives, assumptions and uncertainty can be made explicit in strategic planning, budgeting and investment decisions.
Risk communication
Why technically sound risk information often has little influence, and how the way uncertainty is framed and communicated affects what decision-makers understand, discuss and use.
Risk quantification
When ranges, probabilities and simulation can make uncertainty more explicit and decision-relevant, what they can and cannot tell us, and where quantification reaches its limits.
How I approach risk management
I do not start with a risk management framework. I start with the management problem: which decision or resilience question needs to be addressed, and what uncertainty matters. I then ask which risk management components can make a useful contribution. The management problem should drive the method, not the other way around.
Decision-oriented
Risk management should contribute to consequential management and board decisions and, where relevant, to understanding whether the organization is financially resilient enough to absorb adverse developments. Processes, reports and governance structures are means to those ends, not ends in themselves.
Component-based
I do not treat ERM as one indivisible system. I break it into specific components and ask what each one is supposed to accomplish and through which mechanism it should work.
Evidence-informed
Methods are assessed by the strength and type of support behind them, their limitations and their fit with the management problem. Established practice or inclusion in a framework is not, by itself, evidence of effectiveness.
Different methods require different tests. A quantitative method can have a strong formal basis without proving better organizational outcomes; a heuristic can be useful even when outcome evidence is limited. I therefore make the basis and limits of each component explicit.
- Purpose
- What concrete problem is this component meant to solve?
- Mechanism
- Why should it improve the analysis, resilience assessment, conversation or decision?
- Evidence
- What supports that mechanism — formal theory, empirical evidence or both — and where are its limits?
- Management impact
- What should improve if this component works, and how can we tell in the organization whether it actually helps?
About
I am Professor of Risk Management at the Lucerne School of Business of Lucerne University of Applied Sciences and Arts (HSLU), where I lead the Competence Center Risk & Compliance Management at the Institute of Financial Services Zug (IFZ). I also serve as Head of Research at the IFZ and co-direct the MSc in International Financial Management.
I earned my Ph.D. at the University of St. Gallen and completed my habilitation (Dr. habil.) in Management and Organization Sciences at the University of Sopron in 2024. Within this broader field, my research specialization is Enterprise and Strategic Risk Management, Decision Quality and decision-making under uncertainty. In 2017, I was a visiting scholar at Georgia State University.
My work connects research, teaching and practice around a central question: how can risk management help organizations remain financially resilient and make better consequential decisions under uncertainty?
Work with organizations
Since 2006, I have coached and advised organizations at executive level in risk management and internal control.
My work includes the design and review of enterprise risk management, risk reporting for management and boards, and facilitated discussions on strategic decisions under uncertainty. I work with companies, hospitals, public-sector organizations and non-profits, drawing on current research and established frameworks selectively, depending on the management problem rather than treating any single framework as a complete solution.
The aim is not to make risk management more elaborate, but more useful: for financial resilience, consequential decisions and the way uncertainty is discussed by management and boards.
Selected publications
Management Modern Approaches to Balancing Risk and Reward Third Edition Springer Gabler
in Business
and Management A Practical Guide Springer Gabler
- 2026 Extremrisiken im Risikomanagement: Quantifizierung und ihre Grenzen With Kristian Giesen. Book chapter in Neue Wege der Unternehmenssteuerung.
- 2026 Risikomanagement: Vom Glaubenssystem zum strategischen Führungsinstrument Book chapter in Von der Strategie zum Resilienzmanagement – Die Zukunft nachhaltig gestalten.
- 2025 Entscheidungsorientiertes Risikomanagement: Wie Risikomanagement zum strategischen Entscheidungspartner wird With Kristian Giesen. Risk, Fraud & Compliance (ZRFC).
- 2025 Cyberrisiken in Zahlen: Warum Messbarkeit der Schlüssel zu besseren Entscheidungen ist With Cyrill Baumann. Risk, Fraud & Compliance (ZRFC).
- 2025 Enterprise Risk Management: Modern Approaches to Balancing Risk and Reward, 3rd edition Springer Gabler. Publisher page
- 2025 ERM Report 2025: Corporate Crises in Germany, Austria, and Switzerland With Ute Vanini, Karin Altendorfer, Aron Schalk and Smilla Antonia Nölle. HSLU / HAW Kiel. Study page
- 2025 Return on Compliance: Success Factors of Compliance and Their Contribution to Corporate Value With Mirjam Gruber-Durrer, Christian Hauser and Jeanine Bretti Rainalter. Springer. Publisher page
- 2024 Finanzielle Resilienz während der Coronakrise: Eine empirische Studie aus dem DACH-Raum With Ute Vanini. Risk, Fraud & Compliance (ZRFC). DOI 10.37307/j.1867-8394.2024.02.03.
- 2024 Risikoberichterstattung: Entscheidungsrelevante Information oder formalistisches Ritual? GRC aktuell 3/2024. Article page
- 2024 Research Design in Business and Management: A Practical Guide for Students and Researchers, 2nd edition With Michael Blankenagel. Springer Gabler. Publisher page
- 2023 Cyber-Risiken in das Risikomanagement integrieren With Viviane Trachsel. Controlling & Management Review, 67(2), 26–33.
- 2022 Quick Guide Ganzheitliches Risk Management im Krankenhaus With Philipp Henrizi, Alexander Hilsbos and Thomas Schneeberger. Springer Gabler.
- 2021 Enterprise Risk Management in Switzerland With Mirjam Durrer. In Enterprise Risk Management in Europe, Emerald Publishing.
- 2019 Mit Enterprise Risk Management die Entscheidungsqualität erhöhen With Werner Gleißner. Expert Focus, 10/2019, 745–749.
- 2018 Ganzheitliches Chancen- und Risikomanagement: Interdisziplinäre und praxisnahe Konzepte Edited with Jens O. Meissner. Springer Gabler.
- 2017 Risikomanagement in 10 Schritten With Jens O. Meissner. Springer Gabler.
- 2017 Efficiency of internal control: evidence from Swiss non-financial companies Journal of Management & Governance, 21, 399–433. DOI
- 2015 Erfolg der Internal Control – Eine empirische Analyse aus Sicht des Managements Doctoral dissertation, University of St. Gallen, Dissertation No. 4353. Swiss National Library record
Selected research projects
- 2025–28 Development of Real-Time Monitored Compliance KPIs for the Business Success of Swiss Companies Ongoing Innosuisse project developing success-oriented compliance KPIs, an AI-assisted monitoring dashboard and a reporting methodology linking compliance to strategic and financial performance.
- 2022–25 MinimalTools: Decision Intelligence An Innosuisse-supported approach combining organizational self-assessment and data-based market monitoring to improve strategic decision-making.
- 2021–22 Cyber Risk Management in Larger Swiss Companies A joint study with Mobiliar and economiesuisse on how large Swiss companies integrate cyber risks into enterprise risk management and board oversight.
- 2016–21 Holistic Risk Management in Swiss Hospitals Development and validation of a practical model for implementing integrated Enterprise Risk Management in Swiss hospitals.
- 2010–12 Value-based Risk Management in Mid-sized Swiss Industrial Companies Research on quantifying, aggregating and managing strategic and operational risks, including their implications for overall risk exposure and capital requirements.
Selected ideas
Short pieces and discussions that capture how I think about risk management in practice.
- 2026 Risk management has two tasks Financial resilience and strategic decision quality are connected, but they follow different logics and need different tools.
- 2026 The management problem should drive the method, not the other way around Methods should follow the problem to be solved, rather than forcing every uncertainty into the same risk-management tool.
- 2026 If risk management is about decisions, why are the decision-makers not in the room? A governance question about management attention, ownership and the limits of risk management as a specialist function.
- 2026 Mandated Tools, Missing Impact: Rethinking Risk Matrices Why risk matrices can serve useful governance and communication purposes, but should not be mistaken for a decision model or a quantitative representation of risk.
- 2026 When Good Risk Information Changes Nothing Why risk communication is not packaging at the end of analysis, but part of risk management itself.
- 2026 The most important risks are not found in risk registers. They are created at the decision table. Strategic risk is often created by the choices an organization makes, not simply by external events waiting to happen.
- 2021 Enterprise Risk Management: Glaubenssystem oder Führungsinstrument? A critique of treating accepted frameworks and practices as evidence of effectiveness, and an argument for stronger links to decision theory.
Speaking
I speak regularly at professional and academic events on enterprise risk management, decision-making under uncertainty, risk quantification and risk communication. Selected talks include:
- 2026 When Good Risk Information Changes Nothing Risk Awareness Week
- 2026 Enterprise Risk Management: Moving from Compliance to Better Decisions Risk Society
- 2026 Beyond Numbers: Risikomanagement als Treiber strategischer Debatten Risk Management Congress, Munich
- 2026 Die Wahrheit über wirksames Risikomanagement SwissGRC Day, Zurich
- 2026 Golden Rules of Risk Management Risk-!n Conference, Zurich
- 2025 Cutting Through the Noise: How to Turn Risk Reports into Action SWERMA ERM Day, Gothenburg
- 2024 The role of risk management in decision-making Guest lecture, MSc Finance, University of Sopron
- 2024 Ist quantitatives Risikomanagement dem qualitativen überlegen? Habilitation lecture, University of Sopron
Selected recordings & online sessions
Selected recordings, webinars and online sessions on Enterprise Risk Management, decision-making under uncertainty, risk communication and risk quantification.
- 2026 The Evolution of Enterprise Risk Management Global Risk Summit, Enterprise Risk Quantification Institute · with Linnea Solem · recording and transcript
- 2026 When Good Risk Information Changes Nothing Risk Awareness Week · recorded online workshop on risk communication
- 2026 Enterprise Risk Management: Moving from Compliance to Better Decisions Risk Society · online webinar
- 2025 Frankly Speaking: «Risikomanagement führt zu besseren Entscheidungen» Wirtschaftsraum Bern · Swiss German with English subtitles · Watch on YouTube · Wirtschaftsraum Bern
- 2024 Risk Management and Artificial Intelligence: What Remains for Humans? Swiss GRC Day · German · event recap
Professional roles & affiliations
- Current Council of Advisers — Risk Society
- Current Distinguished Fellow — Enterprise Risk Quantification Institute (ERQI)
- Current Advisory Board — RMA Risk Management & Rating Association e.V.
- Current Advisory Board — SwissGRC
- 2015–22 Chairman — Swiss Enterprise Risk Management Association (SwissERM)
External engagements are undertaken in accordance with my responsibilities at HSLU.