What Makes a Risk Emerging?
An organization may face a risk before it has a long history of losses, stable measurement, or a clear view of how the exposure will develop. New technology, changing environmental conditions, new forms of service delivery, and shifts in customer or supplier behavior can all create this situation. The challenge is not simply to predict a loss. It is to decide what is changing, what the organization is exposed to, and how much confidence to place in the available evidence.
A risk may be described as emerging when new or rapidly changing conditions create a material possibility of adverse outcomes that is not yet well understood, measured, or incorporated into established controls and assumptions. “Emerging” describes the state of knowledge and change around a risk. It does not, by itself, say whether the eventual impact is operational, financial, strategic, or in another enterprise risk category.
The definition does not require the underlying hazard or event to be entirely new. A familiar event can become an emerging concern when exposure changes quickly, when a new dependency increases vulnerability, or when the consequences extend into unfamiliar areas. Conversely, something novel is not automatically a material risk: the organization still needs to identify a plausible adverse outcome and a connection to its objectives.
Emerging Status and Impact Category Are Different Questions
Two separate questions help prevent misclassification. First, what is changing, and how uncertain is the exposure? This question concerns whether a risk is emerging. Second, where would the adverse impact fall if the risk materialized? This question concerns the impact category. For example, a new external service could be associated with uncertain operational impacts if it interrupts a critical process, or uncertain financial impacts if it creates unexpected costs. The emerging label does not decide which impact will occur.
A useful mental model is to record these as two labels rather than forcing one to replace the other. One label describes the risk’s maturity and the quality of knowledge; the other describes the nature of an anticipated impact. A well-understood, long-standing risk can have the same impact category as an emerging risk. The category alone therefore cannot establish whether a risk is emerging.
There is no universal numerical threshold at which a risk becomes emerging. A low frequency estimate does not make a risk emerging, and a high estimated loss does not necessarily make it emerging. The relevant evidence includes how quickly conditions are changing, how well the exposure is understood, whether experience is representative of current conditions, and whether existing assumptions or controls still fit.
Assessing Change Without Mistaking It for Certainty
An emerging-risk assessment should distinguish what is known from what is inferred. A short loss history may reflect genuinely low exposure, but it may also reflect that the exposure is recent, unreported, or not yet stressed. Similarly, a model can produce a precise-looking estimate from assumptions that are uncertain. The number of displayed decimal places does not make the underlying knowledge more reliable.
A disciplined assessment records the changing condition, the evidence supporting it, the material uncertainties, and the possible consequences for the organization’s objectives. It can then identify what new information would change the assessment. This is not the same as asserting that a particular adverse outcome will happen. It is a way to keep plausible exposures visible while evidence develops.
State what is new or moving quickly, such as a new dependency, changed operating environment, or expanding exposure.
Clarify what the organization depends on or is exposed to, and note which estimates, assumptions, or causal links remain weakly evidenced.
Describe how objectives could be adversely affected without presenting a possible outcome as certain or assigning a category solely from the novelty of the condition.
Specify indicators, review dates, or changes in exposure that would prompt reassessment. Update the view when experience or conditions change.
Worked Examples
Worked Example: A Newly Adopted Claims-Review Tool
A hypothetical insurer begins using a recently developed external tool to summarize documents for claims staff. The tool is adopted across several teams in six months. The insurer has only a small pilot history and does not yet know how the tool performs on unusual documents. Identify why the concern may be emerging and distinguish that status from the potential impact category.
Step 1: Identify the changing condition. The new condition is rapid adoption of an external tool in a process that staff use to review claims. The relevant change is not just that the tool exists; it is that reliance on it is increasing quickly.
Step 2: State the uncertainty. The pilot provides limited evidence, especially for unusual documents and performance at wider scale. It is therefore uncertain whether pilot results represent the range of future use. The problem statement should not claim that the tool will make errors; the evidence supports uncertainty about its performance.
Step 3: Separate emerging status from impact. The concern may be emerging because adoption is rapid and performance is not yet well understood. If a tool failure delayed claims handling, the possible impact would be on an operational objective. If errors instead caused unanticipated payments, there could also be a financial impact. Neither impact category follows from the word “emerging.”
Step 4: Name a useful monitoring focus. The insurer could monitor adoption levels, review exceptions and errors, and compare performance across routine and unusual documents. Those measures would help determine whether the exposure and assumptions are changing. The common mistake is to label the risk “technology risk” and stop there; that label does not explain the uncertainty or the possible impact.
Worked Example: A Familiar Hazard and a Changing Portfolio
A hypothetical insurer covers 1,000 properties in a region where flooding is a known hazard. It expects a further 600 properties to enter the covered portfolio next year. For a simple illustration, assume the expected annual claim cost is $200 per property under the current estimate, and assume that estimate is identical for every property. Calculate the current and expanded expected annual claim costs, then explain what the calculation does and does not establish.
Step 1: Calculate the current estimate. Under the stated assumption, the current portfolio estimate is \(1{,}000 \times \$200 = \$200{,}000\) per year.
Step 2: Calculate the expanded estimate. The expanded portfolio contains \(1{,}000 + 600 = 1{,}600\) properties. Applying the same assumed cost per property gives \(1{,}600 \times \$200 = \$320{,}000\) per year.
Step 3: Calculate the change. The increase is \(\$320{,}000 - \$200{,}000 = \$120{,}000\) per year. The calculation is internally consistent: the increase of 600 properties multiplied by $200 per property is also $120,000.
Step 4: Interpret cautiously. The arithmetic shows how a larger exposure changes the estimate if the per-property assumption remains valid. It does not show that the assumption is valid for the incoming properties, that all locations have identical exposure, or that flooding itself is newly emerging. The changing portfolio may make the organization’s exposure an emerging concern if its scale or composition is changing faster than its data and methods can keep pace. The flood hazard remains familiar, and the eventual impacts could be classified separately.
The common mistake is to treat the $320,000 estimate as a reliable forecast merely because the multiplication is exact. The calculation is exact only conditional on its stated assumptions; uncertainty about property mix or per-property cost remains.
Worked Example: A Small Expected Loss Estimate for a New Dependency
A hypothetical firm is assessing a newly introduced data-transfer service. For illustration, analysts assign a 0.01 annual probability to a disruption costing $4,000,000 and a 0.002 annual probability to a separate incident costing $30,000,000. Assume these are annual probabilities, each loss amount is conditional on its stated incident, and expected losses are being used only as a simple screening measure. Calculate the expected annual loss contributions and explain why the total does not settle whether the dependency is emerging.
Step 1: Calculate the first contribution. The expected-loss contribution is \(0.01 \times \$4{,}000{,}000 = \$40{,}000\) per year.
Step 2: Calculate the second contribution. The contribution is \(0.002 \times \$30{,}000{,}000 = \$60{,}000\) per year.
Step 3: Add the contributions. By linearity of expectation, the total for these two loss components is \(\$40{,}000 + \$60{,}000 = \$100{,}000\) per year. This addition does not require the two incidents to be independent, provided the stated contributions are expectations of the losses being summed.
Step 4: Interpret the result. The $100,000 figure is conditional on the assumed probabilities and loss amounts. If the service is new and the probabilities are based on sparse or unrepresentative evidence, those inputs may be uncertain. The estimate alone cannot show that the risk is mature or immaterial, and it does not identify the impact category. The service could create operational disruption, financial cost, or both.
The exam trap is the wrong conclusion: “The expected loss is only $100,000, so this is not an emerging risk.” The calculation itself is not wrong; the inference is. Correctly, the total is $100,000 under the assumptions, while emerging status depends on the novelty and change in conditions and on how well the underlying exposure is understood. A screening estimate is one input, not a complete assessment.
Why the Distinction Matters
Treating emerging status and impact category as separate dimensions helps an organization avoid two opposite errors. It prevents a novel condition from being filed away under a vague “emerging risk” label without considering what objectives could be affected. It also prevents a familiar category from making a changing exposure seem fully understood. The organization can retain the appropriate impact description while also flagging uncertainty and the need for review.
This distinction is especially useful when evidence is limited. A risk register can record a current estimate, but it should also make visible the assumptions behind it and the indicators that may invalidate those assumptions. Useful monitoring may include changes in the number or mix of exposures, adoption of a new process, external developments, near misses, and differences between actual experience and expected performance. Indicators should be chosen because they inform a specific uncertainty, rather than collected simply because they are available.
When the conditions stabilize and evidence improves, a risk may no longer need the emerging label, even though the underlying exposure remains. Alternatively, new dependencies or changing conditions may cause a previously familiar risk to warrant renewed attention. Emerging status is therefore a judgment that should be reviewed, not a permanent property of a particular risk category.
Check Your Understanding
For each scenario, decide what makes the risk emerging, if anything, and keep that assessment separate from the possible impact category.
- A hypothetical insurer has used a long-standing payment process for years, but begins moving half of its transactions to a recently introduced external platform. The first month has no reported losses. What fact supports treating the exposure as potentially emerging, and why does the loss-free month not settle the question? (Answer: Rapidly increasing reliance on a new platform supports treating the exposure as potentially emerging; one month without reported loss is limited evidence and does not establish that the exposure is well understood.)
- A firm has a well-measured, stable exposure to equipment breakdown. The potential effect is interruption of a production process. Is the risk necessarily emerging? (Answer: No. A familiar, stable exposure with well-established measurement is not necessarily emerging; the possible interruption is an operational impact, which is a separate description.)
- A hypothetical insurer estimates 0.005 annual probability of a $2,000,000 loss from a newly deployed service. Calculate the expected-loss contribution and state one reason it may not be a complete assessment. (Answer: \(0.005 \times \$2{,}000{,}000 = \$10{,}000\) per year; for example, the probability may be uncertain because the service is new and has little relevant experience.)
- A company’s known weather exposure is unchanged in type, but the number and geographic mix of insured sites change quickly. What should be reassessed before carrying forward an older estimate? (Answer: Reassess whether the old data and assumptions represent the changed number and mix of sites, and whether the estimate remains appropriate for the current exposure.)
- A new tool may produce either delayed service or unexpected costs. Explain why “emerging” does not determine which impact category should be recorded. (Answer: Emerging describes novelty or uncertainty; the eventual category depends on the nature of the impact. Delayed service and unexpected costs may affect different objectives and should be assessed on their own merits.)