by Dr Keith Smith, Senior Risk Consultant, Risk Advisory & Analytics, Barnett Waddingham 

There are acronyms used in risk and resilience circles to describe the kind of world in which we live. VUCA – Volatile, Uncertain, Complex and Ambiguous and Oxford University has given us TUNA, not the fish, but – Turbulent, Uncertain, Novel and Ambiguous. Both acronyms seem very apt for the risks emerging from the post-Covid recovery left battered and overshadowed by the ongoing human tragedy of war and climate change-related disasters.

In such turbulent times, does it matter if the risks are just labelled risks, or does it help to explore and manage them as risks and emerging risks? Well, it might.

Emerging risk, as a term, can reasonably be used for any risks rising from obscurity into the realm of significance, but there is a more practical application for the term. This is for risks that, in addition to increasing importance, the knowledge required to manage the risk is not yet known because the risk is new to the world, or the risk is only understood when it is seen in other contexts. 

So how does this help? This distinction now gives us three groups, each of which we can and should manage with different styles and resources.

1. Risks which are understood and not in a state of flux. We know how to manage them, and we have adequate plans in place.

2. Risks we know how to respond to, but their significance is changing. 

3. Risks we need to understand before implementing potentially novel plans to manage and match the novelty of the situation.

So with these three groups.

1. Those we class as just “risks” must always be kept under review, and the plans we have still need to be followed through to completion. To take focus away from this activity may be an invitation to fail in something we should be managing. However, in particularly turbulent times, it may not be the best time to tie up precious resources unnecessarily. So even if the risks are serious, if the plans are effective and working, perhaps don’t tie up your best strategic thinkers with this risk area.

2. Risks that we understand but are changing significantly because society is turbulent, volatile or ambiguous in terms of direction. These risks demand attention, but the good news is that once the scope of plausible change is understood, we know how to manage them with either risk or resilience measures. Here we should turn to our scenario analysis tools. What are the plausible directions for the current situation to potentially take? Once these plausible directions are understood, existing control measures can be updated.

3. Risks we see emerging and which we don’t understand yet are the risks that demand additional effort. This is to develop that necessary understanding first. Once understood, the plans we create may also need to be novel, to match the novelty of the plausible futures we have identified. This is where your creative thinkers can contribute most—people with solid ethics and demonstrable strategic problem-solving skills. Again using the scenarios, but taking the work further to try and understand the risks by looking for the small signals of change that could become more significant future risks. 

And what of approaches and tools?

In managing your slow-moving risks, you should generally make the most of structured approaches, established processes, project management skills, and compliance. Indeed, these structured approaches are the recommendations of risk management standards and are the trusted toolset of classic risk management. However, don’t forget that your response to this VUCA or TUNA world means your established procedures should include adequate resilience measures as well as direct action to address significant risks where such action is appropriate.

With your risks that are changing in significance, there should be information gathering, revalidation and analysis. Again, a structured approach of analysis and implementation with updating of actions, controls and maybe some new controls. And again, here, to match the extent of uncertainty and ambiguity, your teams should reassess your resilience measures and address the direct action to manage risks.

For our last group of risks, where we lack data and knowledge, it is time to review and update the scenarios. With emerging risks, unstructured methods will be required at first. Empower the investigators to look for small signals using an information-led strategy, accept that not all paths of inquiry will lead to firm results, and be willing to trust your team’s expertise. 

Don’t have any scenarios? Then it’s perhaps a good time to develop some. Scenarios help organisations join the dots when information is sparse, and the signals are still small enough to be lost in the noise if not joined up with other information. They help you see gaps in knowledge, not all of which you can fill, but where there is no trustworthy knowledge, the scenarios will allow you to incorporate your best assumptions. They are excellent communication tools, and if you are bringing in outside specialists, then the scenarios will be helpful for your different teams to gather.

So to summarise. Breaking down risks into different sets and then matching approaches and resources to each set of risks can make a lot of sense. With risks that are changing and risks that are emerging, scenario analysis is undoubtedly a powerful tool. Capturing new data sets and developing new knowledge requires the flexibility of unstructured methods and trust.

Look out for our article on the ‘Cost of doing business’ in the next edition of The Sentinel.

 https://bw.riskportal.app/home