Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Identifying and Assessing Emerging Risks
What makes a risk emerging
Emerging risks are new, or changing quickly, and hard to size because there’s little history. Generative AI, quantum computing, new regulation and new attack methods have all been emerging risks. The challenge is acting early without overreacting.
Where signals come from
Signals come from threat intelligence, regulators, technology trends, industry bodies, peers and internal incidents.
Assessing under uncertainty
Example. When staff began pasting customer data into public AI chatbots, the practitioner didn’t ban AI outright. A quick scenario analysis showed data leakage was the main risk, leading to an approved tool with data controls and clear guidance.
Useful techniques
- Scenario analysis with best, likely and worst cases.
- Expert judgement using Delphi.
- Ranges instead of single numbers.
- Watch lists reviewed regularly.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| FIRST step with an emerging risk | Assess its relevance to the organisation |
| Little data available | Use scenarios and expert judgement |
| New technology adopted by staff | Assess the risk before banning or approving |
| Where to find early signals | Threat intelligence, regulators, industry bodies |
In short
- Emerging risks are new or changing risks whose likelihood and impact are uncertain.
- Signals come from threat intelligence, regulators, technology trends, industry bodies, peers and internal incidents.
- Assess relevance first: does it affect our assets, sector, technology or objectives?
- Use scenarios and ranges rather than precise estimates when data is scarce.
- Assess before acting; don't jump to buying a solution for a risk not yet understood.
Exam traps
- Ignoring a risk because there's no data on it yet.
- Buying a tool before assessing whether the risk applies.
- Treating every headline as a top risk.
- Waiting for the annual assessment to consider new risks.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Where signals come from
Assessing under uncertainty
ExampleWhen staff began pasting customer data into public AI chatbots, the practitioner didn't ban AI outright. A quick scenario analysis showed data leakage was the main risk, leading to an approved tool with data controls and clear guidance.
1 / 8