Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Integrating Emerging Risk into Decisions
From watch list to register
Reporting uncertainty honestly
Emerging risks rarely fit a heat map neatly. Report them with ranges and a confidence level, explain what would change the assessment, and set out the options. Leaders can decide well with uncertain information if it’s presented honestly.
Response options
| Option | When it fits |
|---|---|
| Monitor | Relevance unclear; watch the indicators |
| Pilot with guardrails | An opportunity worth exploring safely |
| Early controls | Clear risk, with low-cost protection available |
| Avoid for now | Risk clearly beyond appetite |
Example. Post-quantum cryptography was on a bank’s watch list for three years. When standards were published and regulators issued guidance, it moved into the register with an owner, an inventory of affected systems and a migration KRI.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| How to track uncertain new risks | A watch list, reviewed regularly |
| Emerging risk becomes relevant | Add it to the register with a scenario and owner |
| Reporting an emerging risk | Include the uncertainty and the options |
| New opportunity with unclear risk | Pilot with guardrails |
In short
- Keep a watch list of emerging risks even when they're too uncertain to rate precisely.
- Once relevant, give each emerging risk a scenario, an owner and indicators.
- Report emerging risks alongside established ones, with honest uncertainty.
- Options may include monitoring, small pilots with guardrails, or early controls.
- Review the watch list regularly; some risks fade, others become top risks.
Exam traps
- Leaving emerging risks outside the register until they cause an incident.
- Reporting emerging risks with false precision.
- Assuming emerging risks can't be owned.
- Never removing items from the watch list.
Slides
Click the slide and use the arrow keys. F toggles full screen.
From watch list to register
1 / 7