Skip to main content
Regulatory Council
Commerce Security logo, "All 12 PCI DSS Requirements in Plain English," "Get it now for free," "Complete Survival Guide" and a button toclick to get it
Category: Risk Assessment & Analysis

Emerging Risk Radar

Also known as: European Emerging Risk Radar, E2R2
Simply put

An Emerging Risk Radar is a tool or published summary that highlights new or developing risks, along with the broader trends driving them, that could affect an organization or sector in the years ahead. It aims to bring risks onto decision-makers' attention early, before those risks have grown large enough to cause significant harm. The term is used both for specific published reports, such as the CRO Forum's annual radar for the insurance sector, and more generally for the practice of scanning the horizon for uncertain future risks.

Formal definition

An Emerging Risk Radar refers to a structured mechanism for the early recognition, monitoring, and communication of emerging risks, typically defined as new or unforeseen risks that do not yet have a significant impact but are characterized by high uncertainty and potential for rapid change. As applied by the CRO Forum's Emerging Risk Initiative, the Radar is a periodic summary of emerging risks and associated major trends assessed as potentially affecting the insurance sector over a forward horizon (described in the source material as the next five years and beyond). The concept has also been operationalized in initiatives such as the European Emerging Risk Radar (E2R2), which frames the radar as an approach centered on early identification, ongoing monitoring, and management of emerging risks. Usage of the term is context-dependent: it may denote a specific published report, a named initiative, or, more broadly, a horizon-scanning practice within an enterprise risk management program. Applicability, methodology, time horizon, and risk taxonomy vary by organization and sector, and the evidence here draws primarily from insurance-sector and enterprise risk management sources.

Why it matters

Emerging risks are, by their nature, difficult to manage because they do not yet have a significant impact on an organization and are typically characterized by high uncertainty and the potential for rapid change. This creates a timing problem for decision-makers: by the point a developing risk has grown large enough to cause material harm, the window for cost-effective, deliberate response may have narrowed considerably. An Emerging Risk Radar addresses this gap by attempting to surface such risks, and the broader trends driving them, early enough for governance and risk functions to consider them before they crystallize.

The value of a radar approach lies less in prediction than in structured attention. As the Stanford ERM definition frames it, an emerging risk is one that "should be on our radar, but is not." A published radar, such as the CRO Forum's annual summary for the insurance sector, provides a shared reference point for discussing risks and associated major trends over a forward horizon described in the source material as the next five years and beyond. This can help align boards, executives, and risk teams around a common view of what may lie ahead, and can support the integration of horizon-scanning into an enterprise risk management program.

It is important to note that the term is context-dependent and its usefulness varies by organization and sector. The methodology, time horizon, and risk taxonomy differ across initiatives, and much of the available evidence draws from insurance-sector and enterprise risk management sources. A radar does not eliminate uncertainty or guarantee that a given risk will be identified; it is a mechanism for early recognition and monitoring, not a forecast of specific outcomes.

Who it's relevant to

Chief Risk Officers and Risk Management Teams
Risk leaders are the primary audience for emerging risk radars, which support the early recognition and monitoring of risks that do not yet have significant impact. A radar can help embed horizon-scanning into an enterprise risk management program and provide a structured way to bring developing risks to management attention before they escalate.
Insurance Sector Professionals
Much of the available evidence, including the CRO Forum's annual radar, is drawn from the insurance sector, where the Radar summarizes emerging risks and associated major trends that could affect the sector over a horizon described as the next five years and beyond. Insurers and reinsurers may use such published summaries as a shared reference for forward-looking risk discussions.
Boards and Executive Decision-Makers
Because a radar aims to bring risks onto decision-makers' attention early, boards and executives can use it as a common reference point for discussing uncertain future risks and the trends driving them. This supports governance oversight of how the organization anticipates and prepares for developments that are not yet material but could become so.
Enterprise Risk Management and Strategy Functions
Teams responsible for ERM and long-range planning may operationalize the radar as a horizon-scanning practice, adapting its methodology, time horizon, and risk taxonomy to their organization's context. The approach can help connect emerging-risk identification with ongoing monitoring and management activities.

Inside Emerging Risk Radar

Horizon Scanning
A structured process of systematically monitoring the internal and external environment to detect early signals of risks that have not yet materialized or fully crystallized. This activity typically feeds the radar with candidate emerging risks drawn from sources such as regulatory developments, technological change, geopolitical shifts, and market trends.
Emerging Risk Identification
The step of recognizing risks that are newly developing, evolving, or whose potential impact and likelihood are not yet well understood. Unlike established risks, emerging risks are often characterized by high uncertainty and limited historical data, so identification tends to be qualitative and forward-looking.
Assessment Under Uncertainty
An evaluation of an emerging risk's potential effect on objectives and its plausibility, often expressed through scenarios or ranges rather than precise probabilities. Because emerging risks typically lack robust data, assessments are frequently qualitative and revisited as more information becomes available.
Velocity and Proximity Indicators
Attributes sometimes captured on a radar to convey how quickly a risk could materialize (velocity) and how near-term its potential onset is (proximity). These help distinguish risks requiring near-term attention from those warranting continued monitoring.
Visualization Layer
The presentation format, commonly a radar, heat map, or tiered watchlist, that arrays emerging risks by dimensions such as likelihood, impact, or time horizon. The visual is a communication aid to support governance discussion and is not itself an analytical control.
Monitoring and Escalation Triggers
Defined signals, thresholds, or review points that indicate when an emerging risk should be reassessed, escalated, or transitioned into the organization's established risk register and treatment processes.
Governance and Ownership
The assignment of responsibility for maintaining the radar, reviewing its contents, and reporting to relevant committees or the board. This links the tool to the organization's broader governance structures and decision rights.

Common questions

Answers to the questions practitioners most commonly ask about Emerging Risk Radar.

Is an emerging risk radar the same as a risk register?
No. A risk register typically catalogs identified, assessed risks that are already within an organization's field of view, often with assigned owners, treatments, and residual risk ratings. An emerging risk radar, by contrast, is oriented toward risks that are novel, developing, or highly uncertain in their timing, likelihood, or effect, risks that may not yet be well enough understood to assess in the conventional way. The two tools are complementary: items may migrate from a radar into the register as they become better characterized. Practices vary by organization and framework, so the boundary between the two is a matter of convention rather than a fixed rule.
Does placing a risk on the radar mean the organization is managing or controlling it?
Not necessarily. A radar is primarily a monitoring and awareness mechanism; its purpose is to surface and track potential events, not in itself to treat them. Identifying an emerging risk is distinct from applying a control that modifies it. In many frameworks, a radar informs subsequent decisions, such as whether to investigate further, assign an owner, or develop a response, but visibility alone should not be mistaken for mitigation. The presence of an item on the radar does not reduce the underlying risk or guarantee any outcome.
How often should an emerging risk radar be reviewed and updated?
Review cadence is a matter of organizational convention rather than a universal requirement, and it often depends on the volatility of the operating environment, sector, and the resources available. Some organizations refresh a radar on a fixed periodic basis aligned with governance or board reporting cycles, while others also trigger ad hoc reviews when significant external developments occur. The appropriate frequency typically balances the cost of monitoring against the pace at which the relevant risks evolve. Organizations should document their chosen cadence and revisit it as conditions change.
Who should be responsible for maintaining the radar?
Accountability arrangements vary. In many organizations, a risk management function coordinates the radar, but effective identification of emerging risks often depends on inputs from across business units, functions such as legal, compliance, technology, and strategy, and sometimes external sources. Governance structures may assign oversight to a risk committee or board-level body, consistent with the principle that risk management responsibilities should be clearly allocated. The distinction between those who identify and monitor risks and those who own and decide on responses is worth defining explicitly to avoid gaps.
How can emerging risks be prioritized when their likelihood and impact are highly uncertain?
Because emerging risks are by nature poorly characterized, conventional likelihood-times-impact scoring can be difficult to apply and may convey false precision. Some organizations use qualitative approaches, such as assessing velocity, potential magnitude, proximity, or the degree of uncertainty, rather than relying solely on quantitative estimates. Scenario-based thinking and periodic reassessment are common, since an emerging risk's profile may shift materially as more information becomes available. Any prioritization method should be treated as provisional and revisited, and organizations should recognize that judgment, not formula, typically drives these decisions.
How does an emerging risk radar connect to broader governance and reporting?
A radar is often positioned as an input to governance oversight, informing discussions at risk committees or boards about risks that fall outside the established register. Linking the radar to existing risk appetite and reporting processes can help ensure that developing concerns are escalated to the appropriate decision-making level. The specific mechanisms, reporting lines, escalation thresholds, and documentation, depend on the organization's governance structure and any applicable frameworks or regulatory expectations, which vary by jurisdiction and sector. Organizations should confirm that radar outputs feed into decision rights in a manner consistent with their overall governance model.

Common misconceptions

An Emerging Risk Radar is a predictive tool that forecasts which risks will occur and when.
A radar is generally a monitoring and communication aid that surfaces risks under high uncertainty. It typically supports awareness and prioritization rather than providing reliable forecasts, and its contents are usually qualitative estimates that require ongoing revision.
Placing a risk on the radar constitutes managing or controlling that risk.
Identifying and displaying an emerging risk is distinct from treating it. A radar highlights potential events; controls are the measures that modify risk. Effective use typically requires linking radar items to assessment, ownership, and, where warranted, treatment or escalation.
Emerging risks are simply the highest-rated items in the existing risk register.
Emerging risks are often characterized by novelty and limited data, so they may not fit established scoring models and can be underweighted by conventional assessment. A radar is intended to capture developing risks that established registers may not yet reflect, rather than duplicating the register.

Best practices

Establish clear ownership and a defined review cadence so the radar is maintained and discussed regularly by the appropriate governance body, rather than treated as a one-time exercise.
Draw on diverse internal and external information sources during horizon scanning to reduce blind spots, and document the sources and assumptions behind each identified emerging risk.
Use qualitative and scenario-based methods where data is limited, and record the degree of uncertainty explicitly rather than presenting precise figures that the underlying information cannot support.
Define escalation triggers and thresholds that determine when an emerging risk transitions into the established risk register and formal treatment processes.
Keep the radar distinct from, but connected to, the existing risk register so that emerging risks are neither duplicated nor lost when they mature.
Revisit and update the radar as new information emerges, retiring risks that no longer apply and reassessing those whose velocity, proximity, or potential impact has changed.
Application Security Isn’t Optional Anymore.