Introduction

Emerging risks are characterized by their newness, insufficient data, and a lack of verifiable information and knowledge needed for decision-making related to them. As these risks can develop with the potential for large threats and opportunities, appropriate management of emerging risks should be established as a part of an organization’s risk management. It should include changes in circumstances or conditions related to multiple aspects of the organization’s external context and the implications for its internal context.

Emerging risks can include, for example:

— risks arising from unrecognized changes in organizational contexts;
— risks created by innovation or social and technological development;
— risks related to new sources or previously unrecognized sources of risk;
— risks from new or modified processes, products or services.

Consequences of emerging risks can include, for example:

— exposure to unforeseen hazards and threats with uncertain outcomes;
— increased exposure to hazards and threats from known risk sources;
— lost or gained opportunities.

Managing the emerging risk should be knowledge-focused and dependent on the need to accumulate verifiable data and information, especially when these are limited or inconsistent. With interpretation, this information forms knowledge and creates intelligence for strategic, tactical and operational decision-making.

To this aim, this document provides guidelines for applying ISO 31000 to managing emerging risks to enhance organizational resilience. The focus is on emerging risks potentially having the most significant consequences for the organization and its objectives. Applying the ISO 31000 principles and process to managing the emerging risk requires an understanding of the different aspects of the context in which the organization operates. In particular, this applies to the following:

— the continual scanning of changing circumstances or conditions that can result in an emerging risk helps to develop knowledge and provide the intelligence needed for strategic, tactical and operational decision-making;
— the identification of changes in an organizational context is often an early indicator or signal that identifies vulnerabilities and the sources of emerging risks;
— managing emerging risks relies on the application of the ISO 31000 principles under conditions of extreme uncertainty, increasing volatility, complexity and ambiguity within the multiple aspects of the context in which the organization operates.

Specific guidance is provided on:

— how to understand the nature and characteristics of emerging risks (see Clause 4);
— how the principles of risk management apply to emerging risks (see Clause 5);
— how the ISO 31000 risk management process is applied to emerging risks (see Clause 6);
— how resilience can be enhanced by managing emerging risks (see Clause 7);
— how to use the risk intelligence cycle for emerging risks (see Clause 8).

Further details are provided in Annexes A to F.

The application of this document helps organizations to benefit from:

— increased awareness, reducing the likelihood of failing to anticipate emerging risks;
— early recognition of emerging risks and increased level of preparedness and resilience;
— timely dissemination of data and exchange of information among stakeholders;
— alignment of actions on emerging risks across all aspects of organizational contexts.

PD ISO/TS 31050:2023

Risk management. Guidelines for managing an emerging risk to enhance resilience

Current

Published:

30 Nov 2023