In this article, we explore how organisations can move beyond periodic risk reviews to spot emerging threats, respond faster and make better strategic decisions.
What you’ll take away
– How continuous monitoring and clear escalation thresholds help teams act between scheduled risk reviews.
– How AI and predictive analytics can surface early warning signs for people to assess.
– How mapping dependencies and stress-testing scenarios can reveal where a single failure could disrupt several critical services.
– How a speak-up culture, clear ownership and active board oversight help turn early warnings into action.
– How risk appetite can guide decisions about which opportunities are worth pursuing and when to change course.
Imagine a board approving its latest risk register. Each principal risk has a rating and a named owner. Two weeks later, a fraudster uses a cloned executive voice to convince an employee to authorise an urgent payment. Fraud was already on the register. The team now needs to know whether its controls can detect and stop this particular attempt.
A risk register provides a common record of exposures, controls and responsibilities. Dynamic enterprise risk management (ERM) connects that record to current information and decisions. Alongside likelihood and impact, it considers risk velocity, or how quickly a threat can emerge, spread and cause harm. That speed helps determine how often a risk should be monitored and how quickly teams need to respond.
Key risk indicators (KRIs), external intelligence and dashboards can help teams spot a change in exposure between formal reviews. The right monitoring frequency depends on how quickly the risk can cause harm and how much time the organisation needs to act.
Consider a bank that relies on an external provider for customer support. Two missed service targets and a rise in customer complaints may together flag a possible outsourcing failure. If those signals cross an agreed threshold, the service owner escalates the issue to the operational resilience team and tests whether an alternative provider or an internal team can handle the expected volume. The signals matter because someone knows what to do with them.
AI and predictive analytics can help flag unusual transactions, deteriorating service performance or patterns that are difficult to see across separate systems. Poor data and biased models can generate false alerts or miss important ones. Assign someone to review alerts, check the underlying evidence and decide when to intervene. Where relevant, assess the use of AI against applicable requirements under the EU AI Act and data protection law.
In July 2024, a faulty CrowdStrike Falcon content update caused affected Windows systems to crash. The incident illustrates how quickly disruption can spread when many organisations rely on the same technology. Within a single organisation, a shared dependency can have a similar effect. One outage can interrupt payments, customer support and internal reporting at the same time.
Start with a critical service and map the people, systems and suppliers it relies on. Check whether its fallback arrangements share any of those dependencies. A backup supplier offers less protection if it relies on the same platform as the primary provider. Reverse stress testing starts with an unacceptable outcome, such as a prolonged loss of payment services, and works backwards to identify the combination of failures that could cause it.
The EU’s Digital Operational Resilience Act (DORA) requires financial entities in scope to manage ICT third-party risk within their ICT risk management framework. In the UK, the FCA’s operational resilience framework expects firms in scope to map the resources and third-party dependencies that support their important business services.
A frontline employee may spot an unusual transaction or a recurring customer complaint before it appears in a management report. Staff need a clear route to raise concerns and confidence that managers will take them seriously. Managers, in turn, need to know who owns the response, when to escalate and how to record the decision.
Boards can test whether that process works by asking for a recent example. What was the first warning? Who received it? How long did it take to act? What evidence shows the control worked under pressure?
For companies in scope, Provision 29 of the UK Corporate Governance Code 2024 calls for the board to include an annual-report declaration on the effectiveness of material controls as at the balance sheet date. The provision applies on a comply-or-explain basis for financial years beginning on or after 1 January 2026.
A manufacturer stress-testing its supply chain might find an alternative supplier that reduces dependence on a single source and helps it serve a new market. Scenario planning can help management assess the opportunity by testing assumptions about supplier capacity, switching costs and demand before committing.
Risk appetite gives teams a basis for deciding which exposures they can accept and which decisions need further approval. As conditions change, management can revisit its assumptions, adjust its actions within approved limits and bring proposed changes to those limits to the appropriate decision-makers.
A practical starting point is to choose one critical service and agree on an early warning indicator, a threshold for escalation and the person responsible for acting. Test that arrangement in a scenario exercise and see whether the team can respond in time.
Which early warning signal would prompt your organisation to act before its next scheduled risk review?
Resources
European Commission guidance on the EU AI Act
CrowdStrike root cause analysis
EU Digital Operational Resilience Act
Join us to gain insights from Alana Hill, learn practical strategies for turning conflict into opportunity, and discover how challenges can drive growth and stronger team performance.
On All Self-Paced eLearning CPD Courses in Financial Regulation
Hosted by the EIMF and the Chartered Governance Institute
Engage with 20+ leading experts and earn 6 CPD units in Financial Regulation.
Not sure if it’s right for you? Let’s talk.
Discount Coupon: NYNY10
Valid until 31 Jan 2025 23:59
Register now to receive a valuable educational resource each day and be automatically entered into our Grand Christmas Draw on 24th December – Don’t miss out!
On Self-Paced eLearning Courses
*complete your purchase before 21 April 2024