A risk conference is held once a year in which all department heads (second management level), as risk owners, and the risk manager meet with the management to discuss the most significant risks and risk-related issues.