Communicating Emerging Risks to Senior Management

1. Why This Topic Matters

Emerging risks are the risks that organisations are least prepared for: new, rapidly evolving, or poorly understood threats and opportunities whose likelihood and impact cannot yet be estimated with confidence. Examples include generative artificial intelligence, climate transition risk, geopolitical fragmentation, new regulations, supply-chain concentration, cyber threats, and shifts in consumer or workforce behaviour. Because these risks have not yet crystallised, they are frequently absent from the risk register, outside the comfort zone of risk owners, and easy for busy executives to defer.

For the CRMA (Certification in Risk Management Assurance) candidate, this topic sits squarely within the domain of Communicating Risk Management Assurance. The IIA expects risk management assurance providers – usually internal audit – to do more than report on historical control failures. They must help senior management and the board look forward, understand the organisation's exposure to emerging risks, and decide whether risk management processes are adequate to identify and respond to them. An audit function that cannot communicate emerging risks persuasively and on time fails one of its most valuable roles: providing insight and foresight, not just hindsight.

The topic also connects to core IIA requirements. Under the 2017 IPPF, Standard 2060 (Reporting to Senior Management and the Board) requires the chief audit executive (CAE) to report on significant risk and control issues, including emerging risks, and Standard 2120 requires internal audit to evaluate the effectiveness of risk management processes. Under the Global Internal Audit Standards (effective January 2025), Principle 11 (Communicate Effectively) and Standard 11.3 (Communicating Results) carry the same expectation, while Standard 11.5 (Communicating the Acceptance of Risks) sets out the escalation route when management accepts a level of risk the CAE believes is unacceptable. COSO ERM 2017 reinforces this through the component Information, Communication and Reporting, and ISO 31000 treats communication and consultation as a continuous activity throughout the risk management process.

2. What It Is

Defining emerging risks. An emerging risk is typically characterised by:
• Novelty – it is new, or an existing risk is appearing in a new form or context.
• Uncertainty – there is limited data, so probability and impact cannot be estimated reliably.
• Velocity – the speed with which the risk can move from a weak signal to a material event may be high.
• Interconnectedness – it often interacts with other risks, producing cascading or systemic effects.
• Strategic relevance – it may invalidate assumptions underlying strategy, the business model, or risk appetite.

Communicating emerging risks is the structured process of identifying weak signals, assessing their potential significance, translating them into language that decision-makers can act on, and delivering that message through the right channel at the right time to senior management and, where appropriate, the board or audit committee. The purpose is to enable informed decisions about risk appetite, resource allocation, strategy, and the adequacy of risk management processes.

Internal audit's role. Under the Three Lines Model, management (first line) owns and manages risk, risk and compliance functions (second line) provide expertise and monitoring, and internal audit (third line) provides independent assurance. Internal audit does not own emerging risks and should not take management decisions about them. Its role is to: (a) provide assurance that management's processes for identifying and responding to emerging risks are effective; (b) bring independent insight, including emerging risks noted across engagements or through its own horizon scanning; (c) escalate significant concerns through the CAE to senior management and the board; and (d) remain objective, avoiding the perception that it is the organisation's risk function.

3. How It Works

Step 1 – Identification and horizon scanning. Sources include external publications (e.g., global risk reports, regulator speeches, industry bodies), internal data (incident trends, near misses, whistleblowing, audit findings), strategic planning documents, scenario analysis, Delphi-style expert surveys, risk workshops, and discussions with the board, executives and second-line functions. The assurance provider should test whether management's own scanning process exists, is repeated regularly, and covers the full risk universe, not just operational risks.

Step 2 – Assessment. Because historical data is scarce, assessment relies on judgement, ranges rather than point estimates, and qualitative criteria such as velocity, persistence, preparedness and interconnectedness. Scenario analysis and stress testing are used to show what the risk could mean for objectives. The assessment should be linked explicitly to the organisation's strategic objectives and risk appetite so executives can see whether the risk could push the organisation outside tolerable limits.

Step 3 – Prioritisation and filtering. Senior management has limited attention. A long list of speculative threats will be ignored. Emerging risks should be prioritised by potential impact on strategic objectives, speed of onset, and the organisation's current preparedness. Only the most significant items go to the executive committee and the board; the rest can be monitored by second-line functions and reported in summary form.

Step 4 – Shaping the message. Effective emerging-risk communication typically answers four questions:
• What is the risk and what are the signals we are seeing?
• So what – which objectives, assumptions or stakeholders could be affected, and how badly?
• Now what – what options exist (monitor, investigate, mitigate, exploit, accept), and what decision is being asked of management?
• When – what is the likely timeline and what triggers would signal escalation?
The message should be concise, balanced (neither alarmist nor dismissive), free of jargon, explicit about uncertainty and the limits of the evidence, and framed in terms of business impact rather than technical detail. Visual aids such as heat maps, radar charts, trend indicators and scenario narratives help, provided they do not create false precision.

Step 5 – Choosing the channel and timing. Routine channels include the periodic CAE report to the audit committee, the enterprise risk report, the risk committee agenda, and the annual audit plan presentation (which should explain how the plan responds to emerging risks). Non-routine channels include ad hoc briefings, one-to-one discussions with the CEO or CFO, and urgent escalation when a risk is moving faster than the reporting cycle. The guiding rule is timeliness: communication should occur early enough to allow a response, even if information is incomplete, with appropriate caveats.

Step 6 – Tailoring to the audience. The board wants strategic implications, risk appetite alignment and assurance that management is on top of the issue. Executives want operational implications, options and resource requirements. Risk owners want detail and action plans. The same emerging risk may need three different presentations.

Step 7 – Follow-up and feedback. Communication is not complete when the report is issued. The assurance provider should track whether the risk was discussed, what decision was taken, whether ownership was assigned, and whether the risk register, risk appetite statement or audit plan were updated. Feedback from senior management should refine future communications. Where management decides to accept a risk the CAE considers unacceptable, the CAE must first discuss it with senior management and, if unresolved, communicate the matter to the board (Standard 2600 under the 2017 IPPF; Standard 11.5 under the Global Internal Audit Standards).

Common pitfalls include: communicating emerging risks only once a year; drowning executives in a long undifferentiated list; presenting speculative risks with false quantitative precision; failing to connect the risk to objectives or appetite; using technical language; internal audit taking ownership of the response and thereby impairing independence; and failing to document the communication and management's response.

4. How to Answer Exam Questions on This Topic

CRMA questions are typically scenario-based multiple choice. They test whether you can select the most appropriate action for an assurance provider, not merely whether you know definitions. When you read a question about emerging risks and senior management, work through this checklist:

• Identify the role. Is the question asking what internal audit should do, or what management should do? Internal audit assures, advises and escalates; it does not own, accept or treat risks. Eliminate answers that have the auditor making management decisions.
• Look for the audience. The correct answer usually tailors the message to senior management or the board: strategic impact, link to objectives and appetite, decision required.
• Favour timeliness over completeness. If the scenario describes a fast-moving risk, the best answer is usually to communicate promptly with caveats rather than waiting for the next scheduled report or for full data.
• Favour prioritisation. Answers that recommend reporting every possible risk in detail are generally wrong; answers that filter, prioritise and summarise are generally right.
• Remember the escalation path. Disagreement over risk acceptance goes CAE → senior management → board. Skipping senior management or going straight to external parties is almost always incorrect.
• Think about independence. Any answer in which internal audit designs and operates the mitigation, or presents itself as the second line, is a trap.
• Connect to frameworks. Options referencing linkage to risk appetite, strategic objectives, COSO ERM information and communication principles, or IIA Standards on reporting to senior management and the board are usually stronger than generic options.
• Choose the balanced tone. Options that are alarmist, or that dismiss a risk because it cannot be quantified, are usually distractors. The right answer acknowledges uncertainty while explaining potential significance.

5. Exam Tips: Answering Questions on Communicating Emerging Risks to Senior Management

Tip 1 – Read for the word 'most' or 'best'. Several options may be defensible; the exam wants the one that is most consistent with IIA Standards and the assurance provider's role. Rank options rather than accepting the first reasonable one.

Tip 2 – Distinguish emerging risks from existing risks. If a scenario mentions limited data, new technology, regulatory change under consultation, or a trend not yet in the risk register, the examiner is signalling an emerging risk. The correct response will emphasise horizon scanning, scenario analysis and qualitative judgement rather than historical loss data.

Tip 3 – Match the channel to the urgency. Routine emerging risk → periodic CAE report or risk committee. Rapidly escalating emerging risk → immediate briefing of the CEO/relevant executive, followed by the audit committee. Unresolved disagreement on acceptance → the board.

Tip 4 – Remember the four-part message. What, so what, now what, when. An answer that includes the decision requested of management and the link to objectives is almost always stronger than one that only describes the risk.

Tip 5 – Watch for false precision. An option claiming to present an exact probability and loss figure for a genuinely novel risk is a distractor. Ranges, scenarios and explicit statements of uncertainty are the hallmark of good practice.

Tip 6 – Protect independence and objectivity. If an option has internal audit implementing controls, owning the risk response, or signing off management's decision as its own, eliminate it.

Tip 7 – Know the Standards references. Be able to associate: reporting to senior management and the board (2060 / Principle 11, Standard 11.3); evaluating risk management processes (2120 / Standard 9.1 context); communicating acceptance of risks (2600 / Standard 11.5); and COSO ERM 2017 component Information, Communication and Reporting with its principles on leveraging information systems, communicating risk information and reporting on risk, culture and performance.

Tip 8 – Prioritise action over documentation when a risk is live, but never ignore documentation. If a question asks about a fast-moving threat, communicating is the first step; if it asks what should be retained, documenting the communication, management's response and follow-up actions is the correct answer.

Tip 9 – Use elimination. Typical distractors: wait for the next quarterly report; report every identified risk; communicate only to the risk owner; contact the regulator directly; have internal audit design the mitigation; or stop reporting because the risk cannot be quantified. Removing these usually leaves one or two plausible answers.

Tip 10 – Practise with mini-scenarios. Example: During an audit of procurement, the auditor notices that 70 percent of a critical component comes from a single region facing new export restrictions. The risk is not in the risk register and the next audit committee meeting is in four months. What should the CAE do first? Best answer: promptly brief the relevant senior executive and risk function on the potential strategic exposure, with caveats about the preliminary nature of the information, and ensure the matter is reflected in the next report to the audit committee. Weaker options: wait for the meeting; ask the procurement manager to fix it quietly; attempt to quantify the exact loss before saying anything.

Summary

Communicating emerging risks to senior management is about foresight, prioritisation, clarity and timeliness, delivered within the boundaries of internal audit's independent assurance role. In the CRMA exam, the winning answers consistently: identify the emerging nature of the risk, link it to objectives and risk appetite, tailor and prioritise the message for the executive or board audience, communicate early with honest caveats, follow the proper escalation path, and keep internal audit in the role of assurer and adviser rather than risk owner.