Emerging risks are rising – is your risk management keeping pace?

Organizations still need to manage traditional operational risks, but these increasingly overlap with risks linked to supply chains, artificial intelligence and ESG.

A supplier failure can disrupt business continuity. AI can introduce risks related to information security, data protection, compliance, safety and reliability. ESG-related risks can affect operations, supply chains, regulatory compliance and reputation. These are not isolated issues; they can cut across functions and amplify one another.

Risks do not sit in silos

As risks emerge and rise on the corporate agenda, treating each as a separate discipline can make them harder to manage. Inventing a new programme, committee or process for every risk area can fragment oversight, duplicate efforts and leave gaps between functions.

The ViewPoint survey points to a more effective alternative. Leaders – organizations reporting a very well-structured approach across all stages of the risk-management process – address a broader range of established and emerging risk areas. This suggests that emerging risks are brought into existing governance and management systems, rather than tackled through parallel structures.

This is not only more efficient approach. It also provides for improved reputational management. For example, a data breach, environmental incident or poorly governed AI application can undermine trust across the business. An integrated view makes it easier to see these connections, coordinate controls and safeguard the organization overall.

Build on existing management systems

For most organizations who already have a certified management system, much of the foundation for an integrated approach is already in place.

Management systems based on international standards establish processes for assigning responsibilities, identifying and managing risks and opportunities, monitoring performance and driving continual improvement.

In the ViewPoint survey, 57% cite risk-related ISO requirements as a driver for implementing risk-management processes, making this the most commonly reported driver. Seven in ten also say requirements in ISO management system standards make a significant or fundamental contribution to their risk-management culture.

Because ISO management system standards share a common structure, organizations can integrate emerging risks into established processes instead of starting from scratch.

This enables them to reuse governance routines, controls, data, tools and internal competence while connecting related risk areas.

ISO/IEC 42001, for example, provides a management-system framework for artificial intelligence, while ISO/IEC 27001 addresses information security. Used alongside other relevant management systems, these standards can align responsibilities, controls and improvement processes across interdependent risks.

AI shows why risk management needs to connect

The survey shows that 36% consider AI-related risks only occasionally, while 33% do not include them at all.

At the same time, DNV’s separate ViewPoint survey, Starting the Artificial Intelligence Journey, shows how closely AI-related risks connect with established disciplines.

Cybersecurity was the most frequently identified AI-related risk, cited by 50% of respondents overall and 61% of those working on AI implementation. AI risk management therefore cannot sit with IT alone.

Depending on how AI is used, it may involve cybersecurity, information security, privacy, compliance, operational reliability, safety and workforce impacts. Managing these dimensions together helps organizations identify dependencies and avoid conflicting or duplicated controls.

Integration creates clarity and resilience

Integration does not mean blurring accountability. Effective governance still depends on consistent risk classification, clear ownership, defined processes for treatment and monitoring, and clear criteria for escalation. Integrating relevant management system aligned with ISO standards provides a common structure for applying these disciplines across both established and emerging risks.

This common structure helps organizations avoid fragmented governance and apply a disciplined, repeatable approach across functions and risk areas. It enables them to build on established competence, controls and improvement processes rather than create a separate framework whenever a new risk emerges.

Independent third-party certification strengthens this foundation by providing assurance that the management system meets recognized requirements and is being applied in practice. The result is not simply better management of today’s risks, but a resilient foundation for tomorrow.