Horizon Scanning and Scenario Analysis

1. Why Horizon Scanning and Scenario Analysis Matter

Traditional risk registers tend to capture what has already happened or what is already known. Yet the events that cause the greatest damage to organisations are frequently those that were not on anyone's list: a sudden regulatory shift, a disruptive technology, a pandemic, a geopolitical shock, or a rapid change in stakeholder expectations. Horizon scanning and scenario analysis exist to close this gap. They move risk management from a backward-looking, static activity to a forward-looking, dynamic one.

For the CRMA candidate, these techniques sit squarely within Risk Management Governance because they underpin the board's ability to oversee strategy, set and revisit risk appetite, and challenge management on the organisation's resilience to change. COSO ERM 2017 explicitly requires that the entity identifies risk, assesses severity, assesses substantial change and reviews risk and performance, all of which depend on an ongoing view of emerging threats and opportunities. ISO 31000 similarly emphasises that risk management should be dynamic, iterative and responsive to change. Internal audit, as the third line, provides assurance that these forward-looking processes are designed and operating effectively.

2. What Horizon Scanning Is

Horizon scanning is the systematic, ongoing examination of the external and internal environment to detect early signs (often called weak signals) of emerging risks, trends, opportunities and potential disruptions before they fully materialise. It answers the question: What could be coming that we are not yet managing?

Key characteristics:
• Continuous and systematic, not a one-off exercise.
• Outward-looking, drawing on sources such as regulatory consultations, industry bodies, academic research, competitor activity, think-tank reports, media, social sentiment and expert networks.
• Structured by frameworks such as PESTLE (Political, Economic, Social, Technological, Legal, Environmental) or STEEP, to ensure coverage of all categories of external change.
• Focused on emerging risks: risks that are new, evolving, highly uncertain, difficult to quantify and often slow to develop but potentially severe in impact.
• Output: a prioritised list of emerging issues with an indication of likelihood, velocity, time horizon (short, medium, long) and potential relevance to strategy and objectives.

3. What Scenario Analysis Is

Scenario analysis is a structured technique for exploring how a set of plausible future states of the world could unfold, and what each would mean for the organisation's objectives, strategy, finances and operations. It answers the question: If this happened, what would it mean for us and how would we respond?

Key characteristics:
• Scenarios are plausible narratives about the future, not predictions or forecasts.
• Typically multiple scenarios are developed (for example base case, optimistic, severe but plausible, and extreme), often built around two or more critical uncertainties.
• Scenarios combine qualitative storytelling with quantitative modelling of impacts on revenue, capital, liquidity, operations, reputation and compliance.
• Closely related techniques include stress testing (applying a specific severe shock), reverse stress testing (identifying what would cause the business model to fail) and sensitivity analysis (varying one assumption at a time).
• Output: an understanding of vulnerabilities, the adequacy of risk appetite and controls, early warning indicators, and pre-planned response options.

4. How They Fit Together

Horizon scanning feeds scenario analysis. Scanning identifies the emerging drivers and weak signals; scenario analysis takes the most significant of these and tests the organisation against them. Together they form the forward-looking element of the risk management cycle: scan, interpret, scenario-test, respond, monitor, and repeat. Both support strategic planning, risk appetite setting, capital and resource allocation, business continuity planning and the board's strategic conversations.

5. How Horizon Scanning Works in Practice

Step 1 – Define scope and objectives. Clarify which objectives, markets, time horizons and risk categories the scan should cover, aligned to strategy and risk appetite.
Step 2 – Identify sources. Build a diverse portfolio of internal and external information sources to avoid blind spots and groupthink.
Step 3 – Gather and filter signals. Collect data continuously, screen for relevance, and distinguish genuine weak signals from noise.
Step 4 – Analyse and interpret. Assess each emerging issue for potential impact, likelihood, velocity, interconnectedness and time to materialisation. Techniques include expert panels, Delphi method, trend analysis and cross-impact analysis.
Step 5 – Prioritise and escalate. Rank issues and report the most significant to the risk committee, executive and board using an emerging risk register or dashboard.
Step 6 – Integrate into risk management. Add material emerging risks to the risk register, trigger scenario analysis, and adjust risk appetite, strategy or controls as necessary.
Step 7 – Monitor and refresh. Track key risk indicators and periodically re-scan, as emerging risks evolve rapidly.

6. How Scenario Analysis Works in Practice

Step 1 – Define the focal question. For example: How resilient is our three-year strategy to a sharp rise in interest rates combined with supply chain disruption?
Step 2 – Identify key drivers and critical uncertainties. Drawn largely from horizon scanning outputs.
Step 3 – Construct scenarios. Develop a small number of internally consistent, plausible and divergent scenarios. A common method plots two critical uncertainties on axes to produce four scenarios.
Step 4 – Assess impacts. Model the effect of each scenario on objectives, financial metrics, operations, people, compliance and reputation. Involve cross-functional management to challenge assumptions.
Step 5 – Evaluate against risk appetite and tolerance. Determine whether the organisation could remain within appetite and identify where tolerances would be breached.
Step 6 – Develop responses and triggers. Identify mitigating actions, contingency plans and early warning indicators that would signal a scenario is beginning to unfold.
Step 7 – Report and embed. Present results to the board and risk committee, document assumptions and limitations, and incorporate findings into strategic planning and risk appetite reviews.
Step 8 – Review. Repeat periodically and whenever the environment changes materially.

7. Governance Roles and Responsibilities

• Board and board risk committee: set the tone, approve risk appetite, demand forward-looking information, challenge management on emerging risks, and use scenario outputs in strategic decisions.
• Senior management (first line): own emerging risks within their areas, participate in scenario workshops and implement responses.
• Risk management function (second line): typically designs and coordinates the horizon scanning process, facilitates scenario analysis, maintains the emerging risk register, and aggregates reporting.
• Internal audit (third line): provides independent assurance over the design and operation of these processes, and may offer advisory input, but must not own the emerging risk process or make risk appetite decisions, in order to preserve independence and objectivity.

8. The Internal Auditor's Role: What the CRMA Expects

CRMA questions frequently test whether you understand that internal audit evaluates rather than performs these processes on management's behalf. Internal audit should assess:
• Whether a horizon scanning process exists, is documented, and is aligned with strategy and risk appetite.
• The diversity and credibility of information sources and the involvement of appropriate expertise.
• Whether emerging risks are assessed, prioritised, escalated and reported to the board in a timely way.
• Whether scenarios are plausible, sufficiently severe, internally consistent and based on challenged assumptions.
• Whether scenario results actually influence decisions, risk appetite, contingency plans and capital allocation, rather than remaining a theoretical exercise.
• Whether early warning indicators are defined and monitored.
• Whether the process itself is periodically reviewed and improved.

Internal audit should also use horizon scanning in its own risk-based audit planning, ensuring the audit universe and annual plan reflect emerging risks, and keep the audit plan flexible so it can respond to change.

9. Common Weaknesses Auditors Should Look For

• Scanning that is ad hoc, personality-dependent or limited to a single function such as compliance.
• Over-reliance on internal views leading to groupthink and confirmation bias.
• Scenarios that are too mild, too similar to the base case, or designed to confirm existing strategy.
• Failure to connect scanning outputs to the risk register, risk appetite or strategic plan.
• No defined ownership, escalation path or board reporting of emerging risks.
• Lack of documented assumptions, making scenario results impossible to challenge or reproduce.
• Treating scenario analysis as a one-time compliance exercise rather than a living process.

10. Exam Tips: Answering Questions on Horizon Scanning and Scenario Analysis

Tip 1 – Know the definitions precisely. Horizon scanning is continuous identification of emerging risks and weak signals; scenario analysis is structured exploration of plausible future states and their impacts. If a question describes detecting early signs of change in the external environment, the answer is horizon scanning. If it describes assessing what would happen to objectives under a hypothetical future, it is scenario analysis.

Tip 2 – Remember that scenarios are plausible, not predictions. Distractors often describe scenario analysis as forecasting the most likely outcome. The correct answer will emphasise multiple plausible futures and testing resilience, not accuracy of prediction.

Tip 3 – Distinguish related techniques. Stress testing applies a specific severe shock; reverse stress testing works backwards from business failure; sensitivity analysis changes one variable at a time; scenario analysis changes several interrelated variables in a coherent narrative.

Tip 4 – Protect internal audit independence. When asked what internal audit should do, choose answers where internal audit evaluates, assesses, provides assurance or advises. Reject options where internal audit owns the emerging risk register, decides risk appetite, or implements risk responses.

Tip 5 – Link to governance. The best answers connect these techniques to board oversight, strategy setting and risk appetite. If an option mentions informing the board's strategic decisions or testing risk appetite, it is usually stronger than an option focused purely on operational detail.

Tip 6 – Favour forward-looking, systematic and integrated options. Examiners reward answers describing processes that are ongoing, use diverse sources, involve cross-functional expertise, and feed directly into decision-making. Be wary of answers that are one-off, single-source or disconnected from the risk framework.

Tip 7 – Understand emerging risk characteristics. Emerging risks are new or evolving, highly uncertain, hard to quantify, may develop slowly, and can have severe or systemic impact. Questions asking why emerging risks are difficult to manage want these characteristics.

Tip 8 – Apply the three lines. First line owns and manages emerging risks; second line (risk function) coordinates scanning and facilitates scenarios; third line (internal audit) assures. Questions about who should facilitate a scenario workshop typically point to the risk function, not internal audit.

Tip 9 – Use frameworks as anchors. Referencing PESTLE for coverage of external drivers, COSO ERM 2017 principles on identifying risk and assessing substantial change, and ISO 31000 on dynamic risk management will help you spot the best-supported option.

Tip 10 – Read for the weakness being tested. Scenario-based questions often describe a situation with a hidden flaw, such as scenarios all resembling the base case, scanning limited to the compliance team, or results not reported to the board. Identify the governance gap and choose the recommendation that addresses it directly.

Tip 11 – Eliminate absolutes and extremes. Answers claiming horizon scanning can identify all future risks or that scenario analysis guarantees resilience are almost always wrong. Risk management reduces uncertainty; it does not eliminate it.

Tip 12 – Think about internal audit planning too. A recurring exam theme is that the chief audit executive should use horizon scanning to keep the audit plan dynamic and responsive to emerging risks, rather than fixing the plan annually without revision.

11. Quick Revision Summary

• Horizon scanning = continuous, systematic detection of weak signals and emerging risks across PESTLE categories.
• Scenario analysis = structured testing of plausible future states against objectives, strategy and risk appetite.
• Scanning feeds scenarios; both feed strategy, risk appetite and contingency planning.
• Board oversees, first line owns, second line coordinates, third line assures.
• Internal audit evaluates design, operation, integration and board reporting, and uses scanning to keep its own plan dynamic.
• Watch for distractors on prediction versus plausibility, independence, and one-off versus continuous processes.

Mastering these distinctions and the governance logic behind them will allow you to answer CRMA questions on horizon scanning and scenario analysis with confidence.