It’s not easy to see around corners, but increasingly, it’s a requirement that corporate executives and boards are placing on the risk management function. On most days, risk professionals are expected to help manage “known” risks, construct risk finance programs and to generally advise senior leaders regarding the ongoing risks of the business. But some days are different.

There are times when something out of the ordinary occurs, when a new risk emerges: A country half a world away nationalizes a critical commodity, or a once-innocuous virus suddenly spreads among humans or a competitor’s innovation threatens your key product. How such events manifest varies by organization, by industry and by region.

The 2016 Excellence in Risk Management project from Marsh and RIMS, the Risk Management Society, looked at an array of issues around identifying, assessing and managing emerging risks. For some companies, a lack of focus on emerging risks will bring financial difficulty; for those with foresight, they will bring opportunity.

One thing is clear when you try to tease out a consensus definition for emerging risks: There is no consensus.

Defining and Identifying Emerging Risks

Through our survey and related focus groups, one thing became clear as we tried to tease out a consensus definition for emerging risks: There is no consensus definition.

For some, emerging risks are what corporate leaders say they are. “When I get a call from the chief operating officer—who is over our entire university system—it is usually in reference to an article he just read in the Wall Street Journal, which triggers his concern about our position on that issue,” the executive director of risk management for a large university system said. “And if that becomes their issue, then the resources on campus are made available to help.”

For others, the key is the “velocity of risk,” or how fast the risk is approaching and when it will have an impact.

Then there are those who see them as inevitable surprises. “Emerging risks are things that you can’t necessarily prevent,” said the director of risk management at a real estate investment firm.

And finally—with cyber risk as a leading example—a risk can be long-established, but if it is still evolving, many will consider it to be emerging.

The conversations were summarized by the director of risk management at a pharmaceuticals firm: “The standards haven’t been set yet for defining emerging risks.”

Where are the Critical Risks Emerging From?

We chose three broad categories to categorize emerging risks:

The Here and Now

These are critical, dynamic risks that are already a significant concern to the organization, but continue to evolve.

• Cyber attacks: How is it that an issue that has been a top 10 risk in dozens of surveys over the past five-plus years is still viewed as emerging? One reason is that the nature of the threat continues to change and impact more companies in more industries.
• Regulations: Constantly shifting in the U.S. and globally, the regulatory environment can bring significant expenses around compliance and litigation. At the time of our survey, respondents may have been feeling uncertainty around events such as upcoming presidential elections in the U.S. and elsewhere, global regulatory structure(s), such as a potential British exit from the European Union and ongoing changes within their industries.

Around the Corner

Respondents started to shift their outlook to a longer term—one to three years away—when considering some risks, such as:

• Talent availability: The imminent retirement of risk professionals and other employees was the driving force behind the 41 percent of respondents citing talent availability as an area from which their next critical risk will emerge.
• Fiscal crises, sustainability demands and social instability: Although these areas did not draw a high number of overall responses, those who did cite them were likely to see them as risks that would be of significant concern within three years. From an emerging risk standpoint, these can represent areas that may not yet have grabbed much attention, meaning the risk professional who raises them can be contributing heavily to forward-thinking business strategy.

On the Horizon

These are complex and often broad threats and uncertainties that can have unexpected adverse effects on organizations; pinpointing a time frame for them is difficult:

• Climate change, water crises and large-scale involuntary migrations: These areas are highlighted in the WEF Global Risk Report 2016, but tend not to appear on many organizations’ radars. Respondents who do consider these areas may be giving their organizations a chance for a competitive advantage.

• Emerging technologies: What is the next cyber risk? It may lay in wait among the groundbreaking technologies into which research and development is surging: synthetic biology, nanotechnology, artificial intelligence.

Risk Forecasting Expected to Increase in Difficulty

The majority of risk professionals, C-suite executives and financial professionals generally agree that forecasting critical business risks is difficult today and won’t get any easier in the next three years.

Why?

For one thing, the risk landscape is evolving like a version of Moore’s law, seemingly doubling in complexity every few years. The interconnected dynamics of geopolitics, technological advances, global economic integration, social instability, climate change and more mean that the manifestation of one risk is increasingly likely to influence others. So when a known risk—hurricanes, for example—meets with an emerging risk—rising tides—the outcome is not easy to predict. Thus, anticipating emerging risks enhances the ability to predict potential outcomes when risks intersect.

This growing interconnectedness creates an environment where keeping up with evolving issues becomes more difficult. Therefore, success in risk management now often comes to organizations that develop a multidimensional approach to identifying and managing complex risks.

Assessing and Modeling Emerging Risks

Most organizations appear to struggle to assess and model emerging risks. The top response when asked how they do so was the use of “[insurance] claims-based reviews.” This means organizations are relying on studying past incidents to predict how emerging risks will behave. Although there are clear benefits to reviewing claims, there are other tools that are likely more suited to assessing emerging risks. For example, predictive analytics and scenario planning, to name just two.

There is a clear hunger to develop better methods to identify, assess and quantify emerging risks. Nearly three out of four respondents said their organization would benefit by improving the use of analytics to quantify emerging risks.

But risk professionals question whether their organizations will finance the required tools and talent. “Some of the software is really nice, but the amount of time and people it will take to make that software run makes me question whether it’s really going to create value in a company like ours,” said the vice president of risk and insurance at a U.S.-based power company.

Investing to Foresee Emerging Risk

As we have seen in past Excellence surveys, senior leaders’ expectations of the risk management department have increased in everything from leading enterprise risk management to providing better risk quantification and analysis. However, while more is being asked of risk professionals, investment is not necessarily keeping pace.

For example, in this year’s survey, the percentage of respondents that expect to hire more staff dropped to 25 percent from 37 percent in 2015. The good news is that few organizations expect decreased investment overall in risk management; most expect them to at least remain flat.

For those companies that realize increases, the decisions about exactly where to focus spending will be critical, potentially affecting the direction of their department for years to come. It is thus important to consider emerging risks when making these decisions.

Whether they are on your doorstep, around the corner or on the far horizon, emerging risks have the potential to catch your company unaware, or with proper insight and planning, provide opportunity and a competitive advantage.