{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.text}}
From managing risks to preparing for uncertainty
Risk management has traditionally helped organisations identify, assess, and respond to threats and opportunities. What happens when tomorrow’s risks can’t be reliably understood from yesterday’s experience?
A new World Economic Forum (WEF) report, Risk Management, Reimagined: Outlook to 2035, raises precisely this challenge. Only 10% of chief risk officers (CROs) surveyed describe their organisations as very prepared for risks that can’t be modelled using historical data. For Irish organisations, this presents an important question: are our risk frameworks evolving to keep pace with the risks they’re designed to manage?
The need for robust governance and oversight, risk management and internal control is amplified. These fundamentals remain essential for all organisations while the environment surrounding them changes at pace.
The World Economic Forum’s Risk Management, Reimagined: Outlook to 2035 highlights the growing interaction between geoeconomic fragmentation, technological disruption, cyber insecurity, climate volatility, and societal polarisation. These interconnected risks are materialising more rapidly than traditional enterprise risk management approaches were designed to manage. The message isn’t that established frameworks are obsolete, but that they need to evolve.
The risks matter. Their interactions matter more
Risk taxonomies create consistency and enable ownership and accountability. While helpful, in the real world, risks are complex and interconnected and rarely respect these boundaries. A cyber incident can have operational, financial, regulatory, and reputational consequences. A geopolitical event can reshape supply chains, technology dependencies, and markets simultaneously.
The WEF describes this as a shift towards increasingly interconnected and nonlinear risks. More than 70% of surveyed CROs placed both the inability to identify and manage interconnected risks and overreliance on historical data and models among the top limitations of current risk management approaches.
Organisations therefore need to ask not only “What are our top risks?” but also “How might they interact, and are we prepared for the consequences?”
Prediction has limits. Preparedness doesn’t
Preparedness doesn’t replace forecasting, modelling, or risk scoring. It broadens the question. Alongside asking what could happen, how likely it is, and what controls reduce exposure, organisations need to understand what must continue when assumptions fail.
PwC’s 2026 Minimum Viable Company perspective offers a practical way to make this shift. It asks organisations to define their “survival core”: the critical services and outcomes, processes, technology and data, people, and third-party dependencies needed to remain viable through disruption. Rather than treating everything as equally critical, organisations can focus resilience investment and recovery priorities on what must be protected, sustained, or restored first.
This complements the WEF’s shift from prediction towards preparedness. The objective isn’t to anticipate every disruption. It’s to know what absolutely must work when disruption occurs, what can operate in a degraded state, and how recovery should be sequenced.
Bring risk in before decisions are made
The WEF sees risk management increasingly developing from a predominantly protective capability towards one embedded in decision-making. 80% of CRO respondents place embedding risk into strategic decision-making among the top three capabilities critical to the future of risk management.
PwC’s latest research reinforces that direction. The PwC and FERMA Global Risk Manager Survey 2026 finds that 92% of risk managers are involved in corporate strategy. Yet it also identifies an organisational “preparedness gap”, particularly around AI governance, geopolitical volatility, and the speed of technological change.
Risk teams can add greater value when they help management test assumptions and evaluate alternative outcomes before strategic decisions are locked in, rather than primarily assessing how to manage the risks afterwards.
This moves risk from being perceived as the function that asks, “Have we controlled this?” towards one that can also ask, “What needs to be understood for this decision to succeed?”
From periodic reporting to continuous intelligence
If risks can change in hours or days, is a quarterly risk reporting cycle enough?
The WEF expects greater emphasis on continuous sensing, forward-looking analysis, and timely escalation.
This doesn’t mean organisations need to turn every risk metric into a live dashboard. It means reconsidering whether the cadence of risk oversight reflects the velocity of the underlying risk.
Cyber provides a useful illustration. PwC’s Digital Trust Insights Survey 2027 found that 57% of Irish organisations are increasing investment in cyber risk management. Irish businesses are also responding to geopolitical pressures by reconsidering critical infrastructure, operations, suppliers, and insurance arrangements. The challenge is increasingly dynamic. The risk management response needs to become more dynamic too.
AI changes both sides of the equation
AI is both a source of risk and a potential risk capability.
The WEF envisages AI complementing rather than replacing human intelligence. It points to potential applications including monitoring, aggregation, anomaly detection, simulation, and dynamic scenario planning.
PwC research highlights why the human element can’t be forgotten. PwC’s Hopes & Fears Survey 2026 in Ireland found that 51% of Irish workers had used AI at work during the previous 12 months, while 73% felt ready to adapt to new ways of working. At the same time, fewer than half agreed that they had access to the learning and development resources they needed. And risk leaders themselves see a tension. The PwC and FERMA Global Risk Manager Survey 2026 reports that 46% of risk managers already use AI, while 46% consider AI use the least adequately treated risk. That apparent contradiction may capture the challenge perfectly: the future risk function needs better technology, but it also needs better judgement about both the use and capability of technology.
For Irish organisations, 2035 isn’t the starting point. AI adoption, cyber threats, geopolitical uncertainty, and interconnected business models are already changing the risk landscape.
The task isn’t to replace existing frameworks, but to build the capabilities that help them remain effective in a faster and less predictable environment to enable organisations to better respond to and recover from unexpected risks.
Five practical steps to strengthen risk preparedness
You don’t need to predict every disruption to start preparing. Use these five actions to review your framework, clarify what must keep working, and bring risk insight into decisions earlier.
1. Stress-test your framework, not just your risks
Ask whether the existing framework can deal with risks that cross traditional categories, develop rapidly, or lack meaningful historical data. Consider whether risk appetite, taxonomies, reporting, and escalation remain effective under those conditions.
2. Define your minimum viable company
Agree the critical outcomes, services, processes, and dependencies that must remain operational during severe disruption. Sequence recovery priorities and test them against severe but plausible scenarios.
3. Bring risk into decisions earlier
Give risk teams an opportunity to challenge assumptions and explore vulnerabilities while strategic options are still being developed. Risk management creates more value when it informs the decision rather than simply reviewing its consequences.
4. Match risk intelligence to risk velocity
Review whether the frequency of monitoring and reporting reflects how quickly different risks can evolve. Identify where periodic reporting remains appropriate and where quicker indicators, escalation mechanisms, or continuous monitoring would improve decisions.
5. Use technology to augment judgement
Explore where AI and advanced analytics can support risk sensing, aggregation, scenario analysis, and monitoring, while retaining clear human oversight and accountability. The WEF specifically positions AI as complementary to human intelligence rather than a substitute for it.
Risk management is entering a new phase
PwC Ireland helps organisations assess and strengthen enterprise risk management frameworks, governance, and risk operating models so they remain relevant as the business and risk environment changes.
Whether you’re looking to strengthen risk intelligence, challenge existing risk frameworks, embed risk more effectively into strategic decision-making, or explore how technology can improve risk management, we can help you move from managing known risks towards building confidence in uncertainty.
The objective isn’t to predict everything that could happen next. It’s to be ready for what does.
Governance, risk management, and compliance
Building risk-ready organisations.
{{filterContent.facetedTitle}}
{{contentList.loadingText}}
{{contentList.loadingText}}
Follow PwC Ireland
Menu