Emerging and strategic risk
What the exam tests
Emerging and strategic risk: identifying risks that are new, evolving or outside historical data, and linking them to strategy.
Core rules
- Emerging risks are new or changing, with high uncertainty and potentially high impact; historical frequency-severity models are weak.
- Methods: horizon scanning, Delphi, expert workshops, scenario analysis, reverse stress testing, leading indicators and cross-industry data.
- Strategic risks include business model disruption, M&A, competition, technology, climate and geopolitical change.
- Assign ownership at executive level and integrate into strategy reviews, not just the risk register.
- Use 'kill criteria' and trigger points for strategic initiatives.
Worked example
A cyber incident could disable claims processing for weeks. Data are sparse, so a frequency-severity model is unreliable. Instead, run a scenario: systems down 10 days, manual workaround at 20% capacity, customer redress and regulatory notification. Estimate financial and reputational impact, test against appetite and capital. Reasoning: scenario analysis handles low-frequency, high-severity events where data are thin; it also exposes dependencies and manual workaround limits. It is not a prediction but a decision aid.
Traps
Labelling emerging risks as 'unknown unknowns' and doing nothing; forcing them into historical models; no executive owner; treating strategic risk as a one-off planning item; ignoring interconnected risks.