During the third quarter of 2024, Gartner surveyed 286 senior risk and assurance executives and managers to examine and compare emerging risks, which are those whose effects may not yet have been realised by enterprises but have the potential for significant impact. Their evolution is highly uncertain because it is rapid, nonlinear, or both.

“While the upcoming U.S. election generates headlines over the candidates’ regulatory, trade and other proposals, organisations have difficulty considering the actual risk implications from the many scenarios that might unfold. Amplifying this uncertainty are recent U.S. Supreme Court decisions on federal agencies’ authority to set and enforce regulations.”

“Beyond politics, other global events, such as the July CrowdStrike outage, have raised questions about whether organisations over-rely on their largest IT vendors.

“For example, customers with a concentration of services with one vendor may face elevated risk in the event of outages, or they may face unanticipated changes in services depending on new regulations or legal decisions in the EU, U.S. or elsewhere. Because third parties, like SaaS vendors, rely on other vendors, organisations may not realise the full extent of their exposure,” said Ginsburg.

Two of the top five most cited emerging risks are in the technology category and two reflect political concern related to uncertainty around the regulatory and legal environment and the outcomes of global elections. Misaligned organisational talent profile moved down from the fourth-place ranking in the second quarter to the fifth most cited risk in the third quarter.

Recommended reading

• Cybersecurity Workforce Growth Stalls, Skills Gap Widens
• Hiring Practices to Close the 4 Million Worker Gap in Cybersecurity
• ISC2 Study Exposes Gender Disparities in Cybersecurity Workforce

If organisational leaders can generate specific, cost-effective actions that can meaningfully address risks over the duration of a risk event, these are ones that both have a high likelihood of mitigating risk as well as generating executive support.

Finally, beyond assessing the need to act on specific events, risk management leaders should assess organisational capacity to manage disruptions. Factors to consider include the capability to conduct preliminary impact assessment, compliance impact monitoring, and external and internal engagement.

“By going beyond specific risks events to assessing organisational capacity to manage disruption, enterprise risk leaders can both reduce their organisations’ exposure to identified risks as well as enhance resilience to unforeseen events.” said Ginsburg.