Emerging Risks and Organizational Resilience
Emerging risk questions test whether you can reason under high uncertainty without pretending to have frequency data, and whether you understand resilience as a capability rather than a plan on a shelf.
What makes a risk emerging
Novelty, high uncertainty, weak or conflicting data, systemic connections, and potentially fast velocity. Examples include generative AI, cyber and deepfakes, climate physical and transition risk, biodiversity, supply-chain concentration, geopolitical fragmentation, pandemics, demographic shifts, quantum computing and technology obsolescence. Traditional frequency-based analysis may be misleading; use horizon scanning, scenario analysis, Delphi, red teaming, trend analysis and leading indicators.
Resilience
Organizational resilience is the capacity to absorb, adapt and transform in the face of change. ISO 22316 describes principles including coordinated and adaptive leadership, a shared understanding of purpose, a culture that supports resilience, diverse skills and experience, and prepared, redundant and tested arrangements. ISO 22301 sets requirements for a business continuity management system; a business impact analysis identifies critical activities and sets recovery time objectives (RTO), recovery point objectives (RPO) and maximum tolerable periods of disruption (MTPD). Crisis management, stress testing and post-incident learning turn plans into capability.
Worked example
Horizon scanning flags quantum computing as a threat to public-key cryptography within a decade. Likelihood by year is highly uncertain, but impact on confidentiality and digital signatures is severe and the transition is slow. Reasoning: do not demand a precise annual probability; evaluate on impact and velocity, treat as a strategic emerging risk, build a cryptographic inventory, adopt crypto-agility, pilot post-quantum standards, and set triggers such as standards finalization or vendor support. The risk is owned at enterprise level and reviewed at least annually, with scenario exercises.
Traps that cost marks
Dismissing low-likelihood, high-impact risks because they are not on the heat map; forcing historical frequency data onto novel risks; treating a scenario as a forecast; a continuity plan that has never been tested; equating resilience with redundancy alone; ignoring second-order and systemic effects; leaving emerging risks without an owner or review trigger.