This evolving situation necessitates a pivot toward not just recognizing but actively preparing for a wider array of risks. Research suggests that organizations that have invested in building corporate foresight units outperform the average by 33% higher profitability and by 200% higher growth. There is value in thinking backwards to learn from history, and forwards to embrace collective futures.
We asked our industry and risk leaders for their most interesting emerging and interconnected risks that leaders should take back into their organizations and ask “how are we understanding and taking action on this source of emerging risks?”:
$4.45 million to
$5.2 trillion gap
How are we preparing for current and future cyber risks?
The cyber landscape is shifting again. Today, IBM estimates the global average cost of a data breach in 2023 was $4.45 million, a 15% increase over three years.
Average figures hide a diverse range of impacts.
The World Bank estimated that globally, from 2019 to 2023, approximately $5.2 trillion in global value was at risk from cyberattacks. Every month 10.5 million records are lost or stolen, an estimated 438,000 every hour.
These events can have very real impacts for complex organizations, with wide ranging risk sources, and complex causes and consequences that require a holistic framework and risk approach. A key example of these lessons over time includes the experience of a global hotel chain.
In 2018 they announced that hackers had stolen approximately 500 million customer records. The attackers had gained unauthorized access into a company acquired by the hotel chain in 2014 and remained in the system. The access was not discovered until 2018, and the hotel chain was fined £18.4 million for personal data breach by the U.K. Information Commissioner’s Office under the General Data Protection Regulation (reduced from £99.2 million). Wider impacts at the time included: recovery costs, reputational damages from the loss of customer confidence, and legal ramifications through class-action lawsuits raised by those impacted.
In 2022, a further 20 gigabytes of data were stolen through social engineering of an employee to gain access to his or her account — a different method of attack that enabled a different way in.
When organizations experience events, a need arises to think beyond single solutions and risk pathways to ensure resources can support wider resilience.
Key lesson
Those cyber risk numbers only consider today
There is a need to think forwards and with the influx of consumer generative AI programs, such as Google’s Bard and OpenAI’s ChatGPT, the generative AI market is poised to explode.
Bloomberg Intelligence suggests it will grow to $1.3 trillion over the next 10 years from a market size of just $40 billion in 2022.
As the technology evolves at a rapid pace, governance efforts will be critical, especially as AI developers are grappling with the risks inherent in their training data. Every part of your organization will also need to consider the knock-on effects – cyber risks being one of them.
28 $1 billion
events in 2023. What range of losses are assets exposed to across geographies we operate in? How are we thinking about a year of compounding events?
In 2023, the National Oceanic and Atmospheric Administration calculated the U.S. alone had experienced 28 events with losses exceeding $1 billion, well above the average since 1980 of eight events per year and the average for the past five years of 18 events per year. In the U.S., insurers saw the costliest severe convective storms (SCS) year on record, with total claims exceeding $50 billion.
Secondary peril losses, primarily severe convective storms in the U.S. and Europe, contributed substantially to the year’s insurance claims, underscoring their growing influence by cumulative losses outstripping those caused by a season of hurricanes.
Other natural catastrophe perils also set new records, which have knock-on impacts for insurers challenging their own views of aggregations, as well as risk leaders who are taking a second look at the extent of their physical footprint. In 2023 Canada experienced its most extensive wildfire season on record, with 17.94 million hectares burned.
The scale of fires saw the Canadian government close several roads across Quebec, with many companies having to curtail their operations. As wildfire risk increases, a multifaceted approach will be needed that combines early forecasting and anticipation of wildfires with robust infrastructure, effective communication, adaptable policies and consideration of nature-based solutions.
Key lesson
Events once thought rare are becoming more likely or occurring at scales previously not seen …
The historical record alone does not capture the full range of potential risks. By examining what-if scenarios through scenario testing, organizations can gain insights into potential vulnerabilities and develop strategies for a more resilient future. Creating an accurate representation of risk requires a necessary bias check to ensure the impact of recently experienced risks does not shadow those on the horizon. This might include external partnerships — whether board advisors or links with academia — whose role is to challenge your assumptions and add to your knowledge pool.
$57 trillion or
4.1 billion
geopolitical shifts. What insights are we using to shape our understanding of geopolitical risks?
The year 2024 is set to be what the Economist and Time has at the start of the year called “the biggest election year in history,” with national elections scheduled in at least 64 countries plus the European Union, representing 4.1 billion people — close to half the global population (49%) — and an estimated $57 trillion of global GDP. By April that number was 83 national elections in 78 countries. Which is indicative of the way that politics can rapidly ebb and flow. Many will prove consequential for years to come with potential impacts including social stability, reshoring/offshoring, regulatory change and international investment shifts.
Recent research by WTW and Oxford Analytica, published in the WTW Political Risk Index, suggests that geopolitical alignments are shifting rapidly. Inevitably, changes of government are an opportunity for dramatic geopolitical realignments. Investors tend to abhor uncertainty; in some ways, predictable adverse developments are preferable to not knowing the future, which makes it hard to calculate future returns. And 2024’s elections will bring their fair share of uncertainties, raising the importance of organizations to question what sources of information they can call on to ensure they are informed of the wide-ranging impacts of geopolitical risks.
Key lesson
Effective leaders are factoring geopolitical trends into their intelligence monitoring to identify opportunities for growth, while preparing to act quickly and decisively when events occur.
WTW’s Geopolcast provides a thought-provoking discussion of the world’s most pressing geopolitical issues through expert interviews. When discussing risk and strategy, there is a strong role for different perspectives, from external views to considering your own workforce intelligence. Your people are often an untapped view of risk – often dealing with the operational realities of strategic decisions – and can very quickly point at risks and opportunities.
Taking action and finding your path
There is no shortage of approaches that large and complex organizations are using to tackle these challenges. However, there is no one-size-fits-all approach to identifying, analyzing, monitoring and responding to emerging risks. Organizations should remain aware of this and ensure they take account of their culture, experience, technological capability, and colleague attitudes when designing or refining an approach.
How are leading organizations addressing their risk portfolio and financial impact while balancing emerging risks?
Addressing their risk portfolio and financial impact
Through sophisticated risk management strategies to address their risk portfolios and mitigate financial impacts while also considering emerging risks.
- Comprehensive risk assessments
- Diversification
- Stress testing
- Scenario analysis
- Risk transfer
- Continuous monitoring and review
- Collaboration and partnerships
Optimizing risks and what levers/tools/resources
Adopting a proactive, data-driven, and integrated approach to optimizing risks, leveraging a combination of strategic, technological, and organizational levers to enhance their resilience and value creation potential.
- Integrated Risk Management (IRM) frameworks
- Embracing innovation: Data analytics and Artificial Intelligence (AI)/Machine Learning (ML)
- Risk auantification and measurement
- Scenario planning and stress testing
- Risk transfer and hedging strategies
- Crisis management and business continuity planning
- Governance and compliance frameworks
- Collaboration and partnerships
Analyzing changes and influences of emerging risks
Leading with proactive and multi-faceted approach to analyzing changes and influences of emerging risks on their organizations, integrating insights from diverse sources, disciplines, and stakeholders to enhance their risk intelligence and resilience in an increasingly uncertain and dynamic business environment.
- Environmental scanning/threat intelligence/horizon scanning
- Scenario analysis
- Risk workshops and brainstorming sessions
- Risk assessments and heat mapping
- Expert interviews and delphi method
- Data analytics and early warning systems
- Partnerships and collaborations
WTW believes that a truly effective approach should start with establishing and understanding your risk tolerance. This step allows you to identify those emerging risks that can breach this tolerance level and need mitigation, both financial and organizational.
At the core of these approaches is the need to understand what we mean by emerging risks
Organizations use a range of different definitions for emerging risks, refined based on time horizons, risk tolerance thresholds, and strategy deliverables. The recent release of the ISO 31050 – guidance for managing emerging risks to enhance resilience – marks a pivotal moment in the management of these risks at a time when new regulatory standards and requirements are being implemented or considered.
If definitions can vary, what are emerging risks? To quote directly from ISO 31050 they can cover a series of characteristics:
Emerging risks can include, for example:
- Risks arising from unrecognized changes in organizational contexts.
- Risks created by innovation or social and technological development.
- Risks related to new sources or previously unrecognized sources of risk.
- Risks from new or modified processes, products, or services.
Source: ISO 31050
This is a useful starting point, but organizations may wish to simplify this further to make the language clearer and more accessible. An organization could choose to view emerging risks as:
- Circumstances that materially change the profile of risks we’ve already spotted.
- Circumstances that lead to new risks we hadn’t previously spotted.
- Circumstances that cause two or more risks to combine, happen simultaneously or create a domino effect.
In asking whether your existing approach deals with these risks and opportunities appropriately, an organisation may wish to consider three challenge questions:
01
How do you identify and manage emerging risks?
The importance of building an emerging risk process and linking it to the business model probably cannot be emphasized enough. That includes the lens of opportunity. Reviewing emerging risks is also about considering your competitive advantage and, gathering insights into new market opportunities, customer needs, and technological advancements, as well as staying ahead of regulatory developments, compliance requirements, and industry standards that could impact your operations and reputation.
Action: Instigate a horizon scanning regime that extends beyond traditional boundaries, such as a focus on new legislation or financial reporting standards. By asking the question, “What’s new and what does it mean for us?” regularly, new risks and opportunities may become apparent far earlier. By examining what-if scenarios, organizations can stretch their imaginations to gain insights into potential vulnerabilities and develop strategies for a more resilient future. Wargaming is one way of bringing this to life, because the game will focus on risks, but also on actors playing on their competitive advantage - for a more realistic view.
