casemark/managing-emerging-risk-identification

Managing Emerging Risk Identification

When To Use

• Standing horizon-scanning cycles (quarterly, semi-annual) where the risk committee needs a structured inventory of threats not yet captured in the existing risk register
• Ad hoc scanning triggered by macro events — geopolitical shifts, regulatory proposals, technology disruptions, pandemic signals, or sudden market dislocations
• Developing or refreshing early warning indicator (EWI) frameworks tied to specific risk categories
• Preparing emerging risk sections for board risk reports, ORSA narratives, or enterprise risk appetite statements
• Evaluating whether a newly surfaced threat warrants escalation from "watch list" to active risk with capital or limit implications

Inputs To Gather

• Current risk taxonomy and register — existing categorization (credit, market, operational, strategic, reputational, climate/ESG, cyber, model, etc.) so emerging risks can be mapped or flagged as net-new categories
• Scanning horizon — define time bands (e.g., 0–1 year near-term, 1–3 year medium-term, 3–10 year long-term)
• Source universe — regulatory pipeline (proposed rules, consultation papers), industry loss event databases, internal incident trends, macro-economic indicators, technology and competitive intelligence feeds
• Risk appetite statement — quantitative thresholds and qualitative boundaries that determine when an emerging risk crosses into active management
• Prior emerging risk inventory — last cycle's output, including disposition decisions (promoted, retired, unchanged)
• Stakeholder audience — CRO, board risk committee, business-line risk owners, or regulators [VERIFY which governance body receives final output]

Workflow

1. Define scanning scope and horizons

   • Confirm risk taxonomy version in use; agree on time-horizon bands
   • Identify any thematic focus areas requested by leadership (e.g., AI/ML model risk, sovereign credit deterioration, supply-chain concentration)

2. Harvest signals from source universe

   • Scan regulatory proposals, supervisory guidance, and enforcement actions relevant to the firm's jurisdictions [VERIFY applicable regulators — Fed/OCC/FDIC, PRA/FCA, ECB/SSM, MAS, etc.]
   • Review industry loss databases (ORX, SAS OpRisk), peer disclosures (10-K risk factors, Pillar 3 reports), and rating agency sector outlooks
   • Collect internal signals: near-miss incidents, audit findings, model validation exceptions, limit breaches, concentration drift

3. Categorize and characterize each emerging risk

   • For each candidate risk, document:
     • Description — what the risk is and its causal drivers
     • Horizon band — near / medium / long-term
     • Velocity — how quickly impact could materialize (sudden, gradual, episodic)
     • Potential impact channels — P&L, capital, liquidity, operational continuity, reputation
     • Interconnections — linkage to existing register risks or other emerging risks (contagion paths)
   • Assign a preliminary severity rating using the firm's impact/likelihood matrix or a qualitative High/Medium/Low scale

4. Develop early warning indicators (EWIs)

   • For each high- and medium-severity emerging risk, propose 2–4 leading indicators with:
     • Data source and refresh frequency
     • Threshold / trigger level — green / amber / red bands tied to risk appetite
     • Owner — business line or control function responsible for monitoring
   • Examples: CDS spread widening beyond historical percentile, regulatory comment-letter volume spike, patent-filing acceleration in disruptive technology, cyber-threat intelligence score elevation

5. Disposition and escalation recommendations

   • Compare current inventory against prior cycle; for each risk recommend one of:
     • Promote — move to active risk register with assigned owner, limits, and capital treatment
     • Watch — retain on emerging risk list; specify next review trigger
     • Retire — risk has materialized (now active) or dissipated; document rationale
   • Flag any risk where current risk appetite framework has no coverage and recommend appetite-statement amendment

6. Compile management report

   • Produce the emerging risk report with executive summary, heat map visual, individual risk profiles, EWI dashboard design, and disposition decisions
   • Include an appendix listing sources consulted and assumptions made

Output

The deliverable is an Emerging Risk Identification Report containing:

• Executive summary — top 3–5 emerging risks ranked by severity and velocity, key changes from prior cycle
• Heat map — two-dimensional plot of likelihood vs. impact, color-coded by horizon band
• Individual risk profiles — one per emerging risk with description, drivers, impact channels, interconnections, EWIs, and disposition recommendation
• EWI dashboard specification — indicator definitions, data sources, threshold calibrations, and monitoring ownership
• Disposition log — promoted, watched, and retired risks with rationale
• Assumptions and limitations — data gaps, jurisdictional caveats, model uncertainty

Quality Checks

• Every emerging risk is mapped to at least one risk taxonomy category or explicitly flagged as a proposed new category
• EWI thresholds are anchored to observable data and aligned with the firm's risk appetite bands — no arbitrary or undefined triggers
• Interconnections are documented; risks are not treated as independent when common drivers exist
• Prior-cycle risks are explicitly dispositioned — none silently dropped
• Regulatory and jurisdictional dependencies are marked with [VERIFY] where the analysis may not generalize across operating entities
• Report avoids speculative language; where uncertainty is high, confidence level is stated and escalation to subject-matter experts is recommended
• Severity ratings use the firm's approved impact/likelihood definitions, not ad hoc scales [VERIFY alignment with current risk appetite framework version]