Emerging risks are rising – is your risk management keeping pace?

Organisations still need to manage traditional operational risks, but these increasingly overlap with risks linked to supply chains, artificial intelligence and ESG considerations.

A supplier failure can disrupt business continuity. AI can introduce risks relating to information security, data protection, compliance, safety and reliability. ESG-related risks can affect operations, supply chains, regulatory compliance and organisational reputation. These are not isolated issues; they often cut across functions and can amplify one another.

Risks do not sit in silos

As new risks emerge and rise on the corporate agenda, treating each one as a separate discipline can make them more difficult to manage. Creating a new programme, committee or process for every risk area can fragment oversight, duplicate effort and leave gaps between functions.

The ViewPoint survey points to a more effective alternative. Leaders, defined as organisations reporting a very well-structured approach across all stages of the risk management process, address a broader range of both established and emerging risks. This suggests that emerging risks are incorporated into existing governance and management systems rather than being managed through parallel structures.

This approach is not only more efficient, it can also strengthen reputation management. A data breach, environmental incident or poorly governed AI application can undermine trust across an organisation and among its stakeholders. An integrated view makes it easier to identify these connections, coordinate controls and protect the organisation as a whole.

Build on existing management systems

For organisations that already operate a certified management system, much of the foundation for an integrated approach is already in place.

Management systems based on internationally recognised standards establish processes for assigning responsibilities, identifying and managing risks and opportunities, monitoring performance and driving continual improvement. 

In the ViewPoint survey, 57% of respondents cite risk-related ISO requirements as a driver for implementing risk management processes, making this the most frequently reported driver. Seven in ten also say that the requirements contained within ISO management system standards make a significant or fundamental contribution to their organisation’s risk management culture.

Because ISO management system standards share a common structure, organisations can incorporate emerging risks into established processes rather than starting from scratch.

This allows them to make use of existing governance arrangements, controls, data, tools and internal expertise, while creating stronger links between related risk areas.

ISO/IEC 42001, for example, provides a management-system framework for artificial intelligence, while ISO/IEC 27001 addresses information security. Used alongside other relevant management systems, these standards can align responsibilities, controls and improvement processes across interdependent risks.

AI shows why risk management needs to connect

The survey shows that 36% of organisations consider AI-related risks only occasionally, while 33% do not include them in their risk management activities at all.

At the same time, DNV’s separate ViewPoint survey, Starting the Artificial Intelligence Journey, demonstrates how closely AI-related risks are connected to more established disciplines.

Cybersecurity was identified as the most common AI-related risk, cited by 50% of respondents overall and by 61% of organisations actively working on AI implementation. AI risk management therefore cannot sit solely within the IT function.

Depending on how AI is used, it may also involve cybersecurity, information security, privacy, regulatory compliance, operational reliability, safety and workforce-related considerations. Managing these areas in a coordinated way helps organisations identify dependencies and avoid conflicting, overlapping or duplicated controls.

Integration creates clarity and resilience

Integration does not mean reducing accountability. Effective governance still relies on consistent risk classification, clear ownership, defined processes for treatment and monitoring, and well-defined escalation criteria. Integrating relevant management systems aligned with ISO standards provides a common framework for applying these disciplines across both established and emerging risks.

This common structure helps organisations avoid fragmented governance and adopt a disciplined, repeatable approach across functions and risk areas. It enables them to build on existing expertise, controls and improvement processes rather than creating a new framework every time a new risk emerges.

Independent third-party certification can further strengthen this foundation by providing assurance that management systems meet recognised requirements and are being applied effectively in practice. The outcome is not simply better management of current risks, but a more resilient foundation for addressing the risks of the future.