Identifying Emerging Risks

1. Why Identifying Emerging Risks Matters

Most organizations are reasonably good at managing the risks they already know about. The risks that cause the greatest damage, however, are often the ones that were not on anyone's register until it was too late: a pandemic that halts global supply chains, a generative AI tool that reshapes a business model, a sudden regulatory shift, a geopolitical shock, or a reputational crisis triggered by social media. These are emerging risks, and the ability to spot them early is one of the clearest differences between mature and immature risk management.

For the CRMA candidate, this topic sits inside Domain II – Risk Management Governance. The IIA expects you to understand that effective governance is forward-looking, that the board and senior management are accountable for overseeing new and evolving threats, and that internal audit has a distinct role in providing assurance on (and advice about) how well the organization identifies them. Under the Global Internal Audit Standards, the chief audit executive must build a risk-based audit plan that reflects changes in the organization's risk profile and must understand governance, risk management and control processes – impossible to do credibly if emerging risks are ignored. In short, this topic connects strategy, governance, ERM frameworks and internal audit's own planning, which is exactly why it is tested.

2. What Is an Emerging Risk?

An emerging risk is a new, evolving or rapidly changing risk whose likelihood, impact, timing or interdependencies are highly uncertain and for which the organization has limited historical data or experience. Key characteristics include:

• Novelty – the risk is new to the organization, the industry or the world, or an existing risk is manifesting in a new form.
• High uncertainty – probability and impact are difficult to quantify; traditional actuarial or statistical methods may not work.
• Limited data – there is little or no loss history to draw upon, so judgement replaces measurement.
• Long or unpredictable time horizon – the risk may develop over years (e.g., climate transition) or crystallize suddenly (e.g., a cyber event).
• Interconnectedness – emerging risks often cascade across categories (a geopolitical event becomes a supply-chain risk, then a financial risk, then a reputational one).
• Potential for significant impact – including strategic or existential consequences, not merely operational losses.
• Velocity – the speed at which a risk moves from signal to impact; emerging risks frequently have high velocity once triggered.

Typical examples: artificial intelligence and automation, cyber threats and data privacy, climate change and ESG expectations, geopolitical instability, pandemics and health crises, demographic and workforce shifts, disruptive technologies and business models, regulatory and tax changes, supply-chain concentration, and shifts in stakeholder expectations.

It is important to distinguish emerging risks from related ideas that appear in exam distractors:
• Known or current risks are already identified, assessed and on the risk register.
• Black swans are extreme, unforeseen events that are rationalized only in hindsight; emerging risks, by contrast, usually give off weak signals that can be detected if someone is looking.
• Opportunities – emerging change can create upside as well as downside; COSO ERM treats both.

3. How Emerging Risk Identification Works

3.1 Where it fits in the frameworks
In COSO ERM (2017), risk identification is part of the Performance component (identifies risk, assesses severity, prioritizes, responds, develops portfolio view), while the Review and Revision component requires the organization to assess substantial change and review risk and performance – the formal hook for emerging risks. The Strategy and Objective-Setting component requires analysis of the business context, which is where many emerging risks first surface. In ISO 31000, establishing the external and internal context and continual monitoring and review serve the same purpose. Both frameworks stress that risk identification is iterative and ongoing, not an annual event.

3.2 Governance roles – the Three Lines Model
• Board / governing body: sets risk appetite, oversees the risk management framework, challenges management on what could disrupt strategy, and receives periodic reporting on emerging risks.
• Senior management and first line: own the risks, conduct business-level identification, and escalate new threats.
• Second line (risk function, compliance): designs and facilitates the identification process, maintains the emerging risk register or radar, aggregates and reports.
• Third line – internal audit: provides independent assurance that the identification process is designed and operating effectively, offers advisory insight, and incorporates emerging risks into its own risk assessment and audit plan. Internal audit must not own or manage the risks, set risk appetite, or take management decisions – a classic exam trap.

3.3 Techniques and sources
Because historical data is scarce, emerging risk identification leans on qualitative, outward-looking methods:

• Horizon scanning / environmental scanning – systematically reviewing the external environment for trends, developments and weak signals, often structured using PESTLE (Political, Economic, Social, Technological, Legal, Environmental) or SWOT.
• Scenario analysis – developing plausible future narratives (not predictions) and asking how the organization would be affected; especially suited to high-uncertainty risks where probabilities cannot be estimated.
• Stress testing and reverse stress testing – asking what event would break the business model, then working backwards to identify the drivers.
• Expert elicitation and the Delphi technique – structured, anonymous rounds of expert opinion to converge on a view where data does not exist.
• Risk workshops, brainstorming and interviews with diverse participants across functions and geographies to avoid groupthink.
• Trend analysis and weak-signal detection – monitoring early indicators such as regulatory consultations, patent filings, competitor moves, academic research, social media sentiment and near-miss events.
• External intelligence – industry bodies, regulators, rating agencies, the World Economic Forum Global Risks Report, peer disclosures, consultants, insurers and think tanks.
• Key Risk Indicators (KRIs) – forward-looking metrics with thresholds that trigger escalation when a developing risk gains momentum.
• Risk velocity and interconnectivity mapping – assessing how fast a risk could hit and which other risks it would trigger, often shown on a risk radar or network map rather than a simple heat map.
• Strategic planning linkage – embedding risk discussion into strategy setting, M&A due diligence, new product approval and major project gates.

3.4 From identification to action
Identification is only the first step. A sound process will: (1) capture the risk in an emerging risk register or watch list with an owner; (2) assess it using qualitative scales, scenarios and velocity rather than false precision; (3) decide a response – monitor, research further, build contingency plans, adjust strategy, transfer or accept; (4) assign KRIs and triggers; (5) report to management and the board on a regular cycle; and (6) periodically re-evaluate so that risks migrate from the emerging list to the main register (or drop off) as understanding improves.

3.5 Internal audit's specific contribution
Internal audit adds value by: evaluating whether the organization has a formal, repeatable process for identifying emerging risks; testing whether board reporting is timely, balanced and forward-looking; checking that risk appetite is revisited when the environment changes; assessing risk culture and whether staff feel able to escalate uncomfortable news; benchmarking against frameworks and peers; facilitating (but not owning) workshops in an advisory capacity; and continuously refreshing its own risk assessment so the audit plan remains dynamic. The CAE should communicate to the board any emerging risks that appear to exceed the organization's risk appetite or that management has not addressed.

3.6 Common weaknesses examiners like to test
• Over-reliance on historical loss data and backward-looking metrics.
• Treating risk identification as an annual, compliance-driven exercise.
• Siloed identification with no aggregation or portfolio view.
• Risk registers full of well-understood operational items but no strategic or external threats.
• Groupthink, optimism bias and a culture that punishes the messenger.
• Board reporting that is static, backward-looking or overloaded with detail.
• Internal audit plans that are not updated for significant changes in the risk environment.

4. How to Answer Exam Questions on Identifying Emerging Risks

CRMA questions are typically scenario-based multiple choice asking for the best, most appropriate or primary answer. Use the following approach:

Step 1 – Identify whose role is being tested. Ask: is the question about the board, management, the risk function or internal audit? Then apply the Three Lines Model. If an option has internal audit deciding risk responses, setting appetite or owning the emerging risk register, eliminate it.

Step 2 – Look for the framework logic. Answers that describe risk identification as ongoing, iterative, integrated with strategy and linked to monitoring of change align with COSO ERM and ISO 31000. Answers describing a one-off or purely historical exercise are usually wrong.

Step 3 – Match the technique to the level of uncertainty. If the scenario stresses no data, novelty or high uncertainty, favour scenario analysis, horizon scanning, expert judgement or Delphi over quantitative modelling, Monte Carlo simulation based on past losses, or trend extrapolation.

Step 4 – Prefer the forward-looking, external and holistic option. When choosing between sources, external scanning and cross-functional input generally beat reliance on a single internal source. When choosing between reporting formats, those showing velocity, interconnections and trends beat static heat maps.

Step 5 – Remember what emerging risk identification is for. The purpose is to protect and enable strategy and objectives; the best answer usually ties back to strategic objectives and risk appetite, not just to avoiding loss.

Exam Tips: Answering Questions on Identifying Emerging Risks

• Know the definition cold. New or evolving, high uncertainty, limited data, potentially significant impact, often long horizon or high velocity. If an option describes a well-documented risk with years of loss history, it is not emerging.
• Internal audit assures and advises; management owns. Any option implying internal audit assumes management responsibility for identifying or managing emerging risks is a distractor, even if it sounds helpful.
• The CAE must keep the audit plan dynamic. If a scenario describes a major new development (new regulation, acquisition, technology shift), the correct action usually involves reassessing risk and updating the audit plan, not waiting for next year's cycle.
• Scenario analysis is the go-to technique for high-uncertainty, low-data risks. Horizon scanning is the go-to for detecting weak signals. Delphi is the go-to for structured expert consensus. KRIs are the go-to for ongoing monitoring with triggers.
• PESTLE signals environmental scanning. If the question mentions political, economic, social, technological, legal or environmental factors, think external context analysis.
• Board oversight is about challenge and information. Good answers give the board forward-looking, concise, trend-based reporting and encourage challenge of management's assumptions.
• Culture matters. Options that promote open escalation, diverse perspectives and psychological safety beat options that centralize identification in a single expert or function.
• Beware false precision. An answer demanding exact probability estimates for a novel risk is usually a trap; qualitative assessment plus scenarios is more appropriate.
• Interconnectedness and velocity are modern exam themes. Prefer answers that consider cascading effects and speed of onset, not just likelihood and impact.
• Read for the word primary or best. Several options may be partially correct; select the one that most directly addresses the governance issue in the scenario and is consistent with the IIA Standards and the Three Lines Model.
• Eliminate systematically. Remove options that are backward-looking, that confuse roles, that stop at identification without reporting or response, or that are inconsistent with risk appetite.

5. Quick Revision Summary

Emerging risks are new or evolving risks with high uncertainty and limited data. Identifying them requires an ongoing, outward-looking process – horizon scanning, PESTLE, scenario analysis, expert judgement, KRIs and external intelligence – embedded in strategy and governed through the Three Lines Model. The board oversees, management owns, the risk function facilitates, and internal audit provides independent assurance and advice while keeping its own risk-based plan current. In the exam, pick the forward-looking, role-appropriate, framework-consistent answer, and never let internal audit take over management's job.