Ask a chief risk officer what keeps them up at night and the answer is rarely something already on the register. It is the supplier concentration nobody mapped, the regulation still in draft, the technology that moved from pilot to production in a quarter. The register, meanwhile, was last refreshed in a workshop, rated on a five-by-five grid, and filed for the next committee pack.
This article looks at why risk registers drift out of date, what a continuous emerging risk monitoring capability actually contains, how scenario triggers turn signals into action, and where AI agents help while people stay accountable. It builds on our earlier pieces on risk oversight maturity and operational surprise and why audit committees rank ERM first, and it sits underneath the board reporting layer described in risk and audit committee intelligence.
Crest.Digital’s Agentic GRC adds configurable agents that scan external signals and internal indicators, then update your existing register with evidence and owners attached.
Explore Agentic GRCWhy Risk Registers Go Stale Between Reviews
A risk register is a record of judgements made at a point in time. That is useful, and it is also its limit. Ratings reflect what the people in the room knew that week. Entries are owned by managers who have day jobs. Cross-cutting risks, such as a cyber event that disrupts a critical supplier during a geopolitical shock, are scored in separate rows and never combined.
The latest annual Emerging Risks Survey from the Society of Actuaries and Casualty Actuarial Society illustrates how fast the picture shifts. In the 2026 edition, as reported by industry press, 34% of executives named economic risks as the most impactful over the near term, while technological risks led for horizons beyond three years at 34%. Of those looking three or more years out, 27% named adverse outcomes from AI as the single most impactful risk, compared with 8% in the near term. AI adverse outcomes also appeared in a third of the first-selected risk combinations, and cyber events paired with AI outcomes were the most frequently cited pairing.
Two lessons follow for anyone who owns a register. First, the ranking of risks depends heavily on time horizon, and few registers record horizon explicitly. Second, the risks that matter most are increasingly combinations. A register that lists “cyber” and “AI” as separate rows can miss the interaction between them. The survey is a perception study of senior risk and actuarial professionals rather than a measure of loss, so treat it as a prompt for questions, not as an answer.
Frameworks already expect this. COSO’s enterprise risk management guidance links risk to strategy and performance and calls for continual review of changes in the internal and external environment, and ISO 31000 describes risk management as dynamic, responding to change as it happens. In practice, the review cadence is the weak point.
Four Signal Layers Worth Monitoring Continuously
Emerging risk monitoring works best when it is structured. We separate it into four layers, each with a defined source, owner and refresh rhythm.
1. Macro and geopolitical signals. Economic data, sanctions and trade measures, energy and currency movements, and political developments in the regions you operate in. The aim is not to forecast the world but to notice when a development touches an exposure you have mapped.
2. Regulatory and policy horizon. Draft rules, consultations, enforcement actions and supervisory statements, from the EU to national regulators. A draft that will change your obligations in eighteen months belongs on the register today with an owner and a date, a theme we explore for AI in regulatory compliance agents for AI governance.
3. Sector and third-party signals. Peer incidents, supplier distress, concentration in shared technology providers and fourth-party dependencies. These are the signals most often trapped in a procurement or vendor-risk silo, even though they are enterprise risks. Our guide to continuous vendor and third-party assurance shows how the vendor layer feeds the wider register.
4. Internal leading indicators. Control failure rates, overdue remediation, audit findings, incident trends, attrition in critical teams and key risk indicators drifting toward their thresholds. These tell you whether your own capacity to absorb a shock is shrinking, and they connect ERM to the work internal audit already does, as described in AI is moving audit from sampling to continuous assurance.
From Signal to Action: Scenario Triggers and Register Updates
Signals are noise until they are tied to something the organisation cares about. The bridge is the scenario trigger: a pre-agreed condition on a leading indicator that prompts a defined response. For example, a manufacturer might define a trigger as a sustained rise in input costs combined with a supplier’s deteriorating financial indicators in one region. When both conditions hold, the relevant risk owner is notified, the register entry is flagged for re-rating, and a short brief is prepared with the evidence.
Good triggers share a few traits. They are written in business terms, not analytics jargon. They name an owner and an escalation path. They have a threshold that was agreed in advance rather than argued after the event. And they are reviewed, because a trigger that fires constantly is ignored and one that never fires is probably wrong. This is the practical meaning of risk appetite: not a statement on a slide, but a set of conditions that change what people do.
Register updates should follow the same discipline. Every change should record what signal prompted it, who reviewed it, what rating moved and why. That audit trail is what lets the board trust the register, and it is the same principle we argue for in why AI agents need audit trails.
Vendor distress, sanctions exposure and concentration are enterprise risks. The Crest.Digital TPRM platform supplies continuous third-party intelligence across the industries we cover, ready to feed your risk radar.
A Six-Step Plan to Stand Up Emerging Risk Monitoring
We deliver this as a configurable pod rather than a bespoke build: reusable connectors, orchestration, workflow, an evidence repository and an audit trail, with client effort concentrated on your risk taxonomy, sources, triggers and approvals. The sequence is discover, design, connect, deploy, validate, and transfer or manage.
Discover Your Risk Taxonomy and Blind Spots
Review the current register, strategic objectives and recent surprises. Identify which risks have no leading indicator, which have no owner for external signals, and which time horizons the register ignores.
Design Radar, Triggers and Approvals
Define the signal layers, sources and refresh rates. Write scenario triggers with thresholds and owners, and decide what an agent may do alone, such as drafting a brief, and what stays with people, such as re-rating a risk.
Connect Internal and External Data
Integrate the risk register, key risk indicators, incident and audit data, third-party intelligence, and curated news, regulatory and market feeds. A shared taxonomy is what lets a signal find the risk it affects.
Deploy the First Watchlist
Release a focused radar for your top strategic risks, with weekly digests to owners, trigger alerts and draft register updates routed for review.
Validate Against Past Events
Back-test the radar against two or three recent surprises. Would it have surfaced them, and how early? Measure noise as carefully as coverage and tune sources and thresholds before anyone relies on the output.
Transfer or Manage, Then Expand
Hand the capability to your risk team or run it as a managed service. Extend coverage to more business units and risk types, and feed the results into committee reporting.
Step five is where credibility is earned. If the radar could not have flagged last year’s surprise, adjust it before expanding. The IIA positions internal audit as a source of assurance over risk management processes, and a back-tested, logged radar gives internal audit something concrete to assess.
Where Agentic AI Helps, and Where People Decide
Reading hundreds of sources, matching them to a taxonomy and drafting a summary is exactly the work that overwhelms risk teams. Agentic AI can scan the feeds, filter duplicates, map each item to the risks and business units it touches, check whether a scenario trigger has been met, pull supporting internal indicators, and prepare a short brief for the owner. It can also propose a register update with the evidence attached, so the owner reviews a draft rather than starting from a blank page.
The boundary stays firm. Agents read, correlate, summarise and recommend; named people decide whether a risk is re-rated, whether appetite is breached and what the response should be. Each agent action should log the sources used, the rule applied and the reviewer, and AI-related inputs should be treated with the same scepticism as any other: summaries can be wrong, and sources can be biased or manipulated. Clear human-in-the-loop checkpoints keep the radar a decision aid rather than a decision-maker.
Your Turn: How Current Is Your Risk Register?
- Calendar-driven: The register is refreshed quarterly in workshops, external events are discussed ad hoc, and new risks arrive when something goes wrong.
- Partly monitored: Some key risk indicators and news alerts exist, but they sit in different tools and rarely lead to a documented re-rating.
- Continuous and evidenced: Signals are mapped to risks, scenario triggers fire to named owners, register changes carry their evidence, and the committee sees what moved and why.
Where would your Chief Risk Officer place you? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Internal audit’s relationship with third-party risk has historically been reactive — reviewing incidents after they occur rather than providing assurance that controls are operating effectively in real time. Continuous monitoring creates a new opportunity: internal audit can verify that risk ratings are recalculated when trigger events occur, that escalations are documented, and that the board is receiving accurate information about vendor exposure — all of which are more meaningful assurance activities than an annual programme review.
Frequently Asked Questions
Emerging risk monitoring is the continuous scanning of external signals and internal leading indicators to detect risks that are new, changing or not yet on the risk register. It combines macro, regulatory, sector and third-party signals with key risk indicators and scenario triggers, so that risk owners are alerted and the register is updated with evidence between formal reviews. It complements, rather than replaces, periodic risk assessments.
Register risks are known, owned and rated. Emerging risks are developing, uncertain and often cut across several categories, so they may not fit one owner or one row. They usually carry a longer time horizon and weaker data. Good practice records the horizon, the early indicators and a review date for each, and revisits combinations such as cyber events coinciding with supplier failure or AI errors affecting regulatory compliance.
A scenario trigger is a pre-agreed condition on one or more leading indicators that, when met, prompts a defined response: notifying the owner, re-rating the risk, convening a review or activating a plan. Examples include a combination of rising input costs and supplier financial deterioration. Triggers make risk appetite operational because thresholds and responsibilities are set before the event rather than debated during it.
Agents can draft updates, attach evidence and route them for review, but a named risk owner should approve any change in rating, appetite or response. Every proposed change should log the source signal, the trigger or rule applied, the data used and the reviewer. This keeps accountability with management, supports internal audit review, and aligns with the human-in-the-loop principle in frameworks such as COSO ERM and ISO 31000.
A focused first release covering the top strategic risks, a handful of signal sources and a few scenario triggers can usually be scoped, built and back-tested within weeks, because connectors, workflow, evidence repository and audit trail are reusable. The client-specific work is aligning the risk taxonomy, choosing sources, agreeing thresholds and defining who approves what. Back-testing against recent surprises gives a practical measure of usefulness before the output is relied on.