How do risk leaders use scenario testing to prioritise emerging risks?

There is a multitude of emerging risks that could impact your organisation, but how do you work out which are most material to the business?

Although it can be difficult to assess emerging risks which, by their nature, are uncertain, organisations are building and testing scenarios to determine which threats and opportunities they should focus on.

Though this article digs deeper into how risk teams are using scenario testing to prioritise emerging risks, an important first step is to be clear on the wider context of your organisation’s emerging risk management efforts.

Many CROs implementing meaningful horizon scanning at their organisations are fixing their attention on the long-term strategy of the business.

Only thinking about emerging risks’ impact on the business as it stands currently is less useful than thinking about their impact on what the company wants to do (or become) in the future.

With this in mind, an important step for many organisations – as they build their emerging risk frameworks – has been to align emerging risks with their strategic objectives. Without trying to overcomplicate the matter, these companies are asking themselves the question: how will the emerging risks on our radar stop us achieving our objectives?

Another key consideration practitioners have echoed is the philosophy of pursuing progress rather than perfection. Organisations cannot be prepared for all the possible outcomes that might occur. Often, the best option is to prioritise the emerging risks that are most relevant to the business’ critical functions and keep a watchful eye on the rest.

Below, we have highlighted the scenario planning practices risk leaders are implementing to decide which emerging risks are most material to them, with an eye on the future state of the business.

Scenario planning: what could the future look like?

Instead of planning for an individual event that may occur, in isolation, many risk leaders consider different combinations of events (or scenarios) that could form based on emerging risks materialising. For example, under the banner of an emerging risk like geopolitical conflict, a war breaking out could have knock-on effects, including trade disputes, sanctions, and a rise in the prices of goods and materials.

So, where do you start with scenario planning? Based on insights from our members, here are three ways you can kick off this process:

• Consider disruptors to the business – If Risk and Strategy work closely with one another, and the business is already thinking about emerging risks’ impact on long-term, strategic objectives, setting a baseline of expectations as to how the world and organisation will look in the future, and building scenarios that may affect this picture, can be a helpful approach.
• Base scenarios around emerging risk themes – If risk owners are already quite engaged on risk matters, the risk team can look at the major emerging risks that may impact the business and build sets of scenarios around these. These scenarios may highlight useful indicators that can be assigned to risk owners, so they can monitor whether a particular scenario is becoming more likely or moving at a higher velocity. These may be the risks a company chooses to prioritise.
• Use the PAPA approach – If risk matrices work for your business, using a chart to organise different scenarios could help you prioritise which ones you need to focus more attention on. For example, in the graph below, scenarios would be split into four categories based on: i) whether they are developing quickly or slowly; and ii) whether the impact of this scenario materialising is high or low.

Stress-testing: how prepared is your business?

While developing scenarios may help a business to determine which emerging risks could have a material impact, stress-testing these scenarios will demonstrate how well the business can respond to the development of these specific threats and/or opportunities.

When stress-testing a scenario, to assess whether the business is prepared for either one or a set of emerging risks, it’s important to ask the right questions. This extends beyond simply, will it affect sales or not? For example, what are the human factors at play – if a particular kind of emerging risk materialises, will it affect the ability of the business to attract and retain talent? Also, will there be any impact on systems or infrastructure, limiting the business’ ability to operate as normal?

To answer the questions, and many more, businesses can set up workshops with managers across different departments to get them thinking about what they would do if certain scenarios actually happened – you may even want to run a simulation exercise and test how well the wider organisation responds and adapts. This activity will highlight where the business is not as well prepared and thereby can you prioritise which emerging risks to focus on.

Where does Risk Leadership Network's insight come from?  These recommendations were drawn from lessons shared by risk leaders in our network, who have been discussing the topic of emerging risk in a series of recent meetings. Our emerging risk guide is available for free, but there's so much more collaboration taking place between risk leaders in our network every day. Find out more about how we enable collaboration here. Members of Risk Leadership Network are using our Emerging Risk Maturity Model to increase their emerging risk maturity. Request to participate here.