UFOQ.AI

02Emerging risk lists name topics, while the damage travels through dependencies nobody mapped

Costly effects often start in someone else's sector. On 2 March 2026, an adviser to the commander of Iran's Revolutionary Guards declared the Strait of Hormuz closed [2]. Oil and gas prices moved first: Brent crude rose 27% and Dutch gas futures 74% between 27 February and 9 March [1]. For a food producer far from the Gulf, the closure also arrived through fertiliser, since about a third of world seaborne fertiliser trade passes through the strait [1].

It has happened before. After the 2011 Japan earthquake, Ford slowed production of vehicles in four colours because the only plant making one paint pigment had shut [3]. Later that year, floods in Thailand disrupted hard-drive production [4]. Intel, which makes no hard drives, then cut its fourth-quarter revenue outlook by about USD 1 billion as computer makers bought fewer processors [5]. Each time, the damage came through a dependency, not the company's own industry.

Current tools stop short of the organisation. The World Economic Forum's Global Risks Report rests on a perception survey and maps how risks connect globally [6]. The CRO Forum's radar rates topics by impact and notes that impact differs by company [7]. Swiss Re's SONAR rates themes for insurance business lines [8].

The International Risk Governance Council (IRGC) sets out a full process for emerging risk, but recommends judging that process rather than its outcomes [9]. ISO 31000 [10] and the enterprise risk management (ERM) framework of the Committee of Sponsoring Organizations (COSO) [11] set out how risk is governed. Neither sets out how to spot an outside change early and trace it to one organisation's exposure.

The question for a risk team is how to turn outside change into owned decisions about its own exposure, early enough to act. The Horizon Loop answers it by starting from what the organisation depends on, and ending with a call it can later check.

03UFOQ defines emerging risk by its reach into what you depend on, not by the topic it belongs to

Our definition. An emerging risk is a change, new or in new conditions, that could affect what an organisation depends on, for better or worse, before it can measure its own exposure.

Published definitions tend to describe the risk itself. The CRO Forum describes risks that are newly developing or changing, highly uncertain and potentially material [7]. IRGC describes a new risk, or a familiar one in unfamiliar conditions [9].

We agree with both, and add the organisation. A change is an emerging risk for you when it can reach something you rely on before you have measured what it would do. The event itself may already be priced: oil prices moved within days of the Hormuz closure [1]. What often stays unmeasured is how the change reaches a particular organisation.

Four tests decide whether something is an emerging risk

All four must hold. If one fails, the item is something else, and it belongs somewhere else.

Slow changes count. A drift such as rising temperatures or a shift in litigation is dated by the point it crossed a threshold that matters to you. The tests are applied at the end of Scan, as the gate into Trace.

Three principles make the definition work in practice

Emergence is relative. A risk can be well known in one industry and new to yours. IRGC ties emergence to what is known about a risk [9]. Published descriptions of ISO/TS 31050, the technical specification on emerging risk that ISO issued in 2023, include risks an organisation has not known or considered [12]. That is why the Horizon Loop starts from your dependencies, not from a global list.

Emerging is a stage, not a category. Every risk on today's register was once emerging. A risk leaves the Horizon Loop when it can be measured and priced, and normal ERM takes over, as Exhibit 1 shows.

Source: UFOQ analysis, drawing on IRGC (2015) [9] and published summaries of ISO/TS 31050 [12].

It cuts both ways. ISO 31000 defines risk as the effect of uncertainty on objectives, positive or negative [10]. The same change that threatens one dependency can open an opportunity elsewhere, so the Horizon Loop sizes both.

04The Horizon Loop runs six steps, from what you depend on to a scored record of your calls

The framework is a repeating cycle, shown in Exhibit 2. Each step answers one question and produces one output that the next step uses.

Source: UFOQ analysis.

1. Anchor: map what the organisation relies on, so every signal has somewhere to land.
2. Scan: log dated, checkable signals of change against those dependencies.
3. Trace: follow each change through its first-, second- and third-order effects to a named exposure.
4. Size: give a range, a timing window and a stated confidence level.
5. Own: hand the risk to a named owner, with triggers and a first action.
6. Review: score past calls, retire stale signals and start the next cycle.

05Step 1, Anchor: start from what you depend on, because that is where outside change lands

What it is. A short map of what the organisation relies on to meet its objectives: suppliers and their suppliers, routes, markets, rules, systems, sites and people. Each dependency is written with the assumption it rests on. Anchor builds on work many organisations already have, such as business impact analysis and supplier mapping, and adds that assumption.

Why it matters. Damage travels through dependencies, often ones two steps away. After the 2011 Japan earthquake, Ford restricted orders for some paint colours because the only plant making a pigment it used had shut [3]. IRGC's guidance on systemic risk begins by mapping the system and the organisation's place in it [13], and framework foresight likewise starts by defining the domain [14].

Key questions

• What must keep working for us to meet this year's objectives?
• Where do we rely on a single source, site, route or system?
• What does each dependency assume about the world?
• Which dependencies sit with our suppliers' suppliers?

What good looks like. Each dependency names its assumption, for example "Gulf fertiliser reaches us on normal routes at normal prices". The business owners of each dependency have confirmed the map. It is updated whenever the business changes shape: a new market, supplier, system or rule.

Common pitfalls

• An inventory of everything, with no view of what matters most.
• Stopping at direct suppliers, when the Ford case shows the risk sat further back.
• Listing assets instead of assumptions, which leaves nothing to test.

Example. For Ford in 2011, the dependency was a specific paint pigment, and the assumption was that its single plant would keep producing [3]. Written that way, a natural-hazard signal in one region links directly to car production elsewhere.

06Step 2, Scan: log dated events against your dependencies, and keep what happened apart from what you think it means

What it is. A regular search for dated, checkable events that suggest a dependency's assumption may be changing. Each signal is logged with its source, its event date and what happened. What it might mean goes in a separate field.

Why it matters. Ansoff argued that strategic surprises are usually preceded by faint, incomplete information that normal planning filters out [15]. Hiltunen showed that a signal has three parts: the sign itself, the change underneath it, and how the reader interprets it [16]. A signal can be clear and still be misread, which is why the log keeps observation and interpretation apart.

Key questions

• Which of our assumptions does this event challenge?
• Is it an event that happened, or someone's opinion about the future?
• Is it independent of signals we already hold, or the same event reported again?
• What would follow if this became common?

What good looks like. Every signal is scoped to a dependency, dated by the event rather than the article, and tagged by source type (regulator, court, filing, research, press). UFOQ treats three or more independent signals that share one mechanism as a cluster worth naming. Scan ends with the four tests: only a cluster that passes all four moves on to Trace.

Common pitfalls

• Collecting trends and news that everyone already knows, which makes the log a digest, not an early warning.
• Counting three articles about one event as three signals.
• Never retiring anything, until nobody opens the log.

Example. On 22 June 2025, Iranian state media reported that parliament had backed closing the Strait of Hormuz [17]. The final decision rested with the country's national security council. For a buyer of Gulf fertiliser, that was a signal against the assumption of normal supply.

In November 2024, the US Financial Crimes Enforcement Network (FinCEN) issued an alert on fraud using deepfake media [18]. For a finance team, that was a signal against the assumption that a live video call proves who someone is.

07Step 3, Trace: follow each change through its first-, second- and third-order effects until it reaches a named exposure

What it is. For each cluster, write out the chain from event to impact, ending in a one-line mechanism. First-order effects are what the event changes directly. Second-order effects fall on the people and systems that depend on those. Third-order effects are where the change reaches you or your customers.

Why it matters. Pescaroli and Alexander argue that the size of a cascade depends more on the weaknesses of the systems it passes through than on the strength of the original hazard [19]. Global maps, such as the World Economic Forum's map of how risks connect, show links in aggregate [6]. They do not show how one event reaches one organisation, which is the gap this step fills.

Key questions

• What is the first thing this change breaks, moves or reprices?
• Who depends on that, and what will they do next?
• Where does the chain touch one of our dependencies?
• Which link is weakest, and so most worth watching?

What good looks like. Each order names an actor, an effect and a rough timing, and the mechanism fits in one sentence. Standard analysis techniques such as event trees can draw the chain. Branches into other sectors are drawn, not ignored, and upside effects are traced as well as losses.

Common pitfalls

• Stopping at the first order, which is the part everyone else has already noticed.
• Tracing everything to everything, until the map explains nothing.
• Mistaking two things moving together for a mechanism.

Example. The 2011 Thailand floods show a full chain. First order: the floods disrupted hard-drive production [4]. Second order: computer makers could not get enough drives. Third order: Intel, which does not make drives, cut its quarterly revenue forecast as computer makers ordered fewer processors [5].

08Step 4, Size: give a range, a timing window and a stated confidence level instead of a false point score

What it is. A short risk thesis for each traced risk. It states how large the effect could be (as a range), when it could land, how soon a decision is needed, and how confident we are. It sizes upside as well as downside.

Why it matters. A single likelihood-times-impact score for something with no loss history gives false precision. COSO's guidance adds speed of onset and preparedness to likelihood and impact [20]. IRGC warns that when an impact lands is not when a decision is needed: an impact years away may need a decision now [9].

Key questions

• What is the plausible range of effect on the exposure we traced?
• When could it land, and by when must we decide?
• How strong and consistent is the evidence?
• Is there an upside for us in the same change?

What good looks like. Every thesis uses one confidence scale, so readers can compare risks with each other and over time. The theses are then ranked by size and decision date, so the board sees the few that matter most. UFOQ uses the scale below, with one extra term for risks that cannot yet be sized honestly.

Common pitfalls

• A precise figure for something nobody has measured, which undermines the whole paper.
• Stacking hedges ("could possibly") instead of choosing a term.
• Forgetting the decision date, so a distant impact is treated as a distant decision.

Example (illustrative). For the deepfake risk, the exposure is every payment that can be released after a call. In the Arup case, one employee made 15 transfers worth about USD 25.6 million after a video call with faked colleagues [21]. A thesis would size the range against the organisation's own payment limits, state when controls must change, and give its confidence level.

09Step 5, Own: hand each risk to a named person, with triggers set in advance and a first action

What it is. The handover from foresight to management. Each risk gets a named owner in the business, a response level, triggers that move it between levels, and a first action. It is written in the same fields as the existing risk register, so the board sees new content in a familiar format.

Why it matters. In UFOQ's view, emerging risk work most often fails here: something is spotted, discussed, and left with nobody's name next to it. The UK Prudential Regulation Authority (PRA) expects insurers, once emerging risks are identified, to name risk owners and controls and to agree management actions [22]. COSO's guidance on key risk indicators recommends setting trigger points in advance [23].

Key questions

• Who in the business owns the dependency this risk would hit?
• Are we watching, preparing or acting?
• What observable event would move it to the next level?
• What is the first step, and by when?

What good looks like. Three response levels, following Ansoff's idea of a response that grows as knowledge grows [15]: watch, prepare, act. The owner watches the triggers between cycles and reports at each review. Each risk is written in ten fields:

Common pitfalls

• A committee as owner, which means no owner.
• Triggers so vague that nobody can tell when one has fired.
• A new format for emerging risks, which the board then has to learn.

Example. The table above turns a headline ("AI and deepfakes: high") into something one person can act on. Its first action can start the next working day.

10Step 6, Review: score your past calls, misses included, and retire what went nowhere

What it is. A dated record of every call made in step 4, checked against what happened on a set review date. The same review decides which signals to retire and which dependencies to add; Scan and Anchor carry out those changes.

Why it matters. IRGC notes that emerging risk work is hard to evaluate because avoided losses cannot be seen, and recommends judging the process instead [9]. UFOQ judges both the process and the calls. Tetlock and colleagues argue that explicit forecasts scored against outcomes make debate more transparent and forecasters more accountable [24]. In a geopolitical forecasting tournament, training, teamwork and tracking measurably improved forecasters' accuracy [25].

Key questions

• Which calls came true, which did not, and which are still open?
• Were we right for the right reasons, or lucky?
• What did we miss entirely, and which dependency should have caught it?
• Which signals are old enough, and isolated enough, to retire?

What good looks like. Every call is dated, carries a confidence term and a review date, and is never edited after the fact. Misses are recorded as carefully as hits. The record is reviewed on a fixed date, not when convenient.

Common pitfalls

• Only reviewing the calls that came true.
• Calls worded so loosely that any outcome counts as right.
• Skipping the review once the paper or the board meeting is over.

Example (illustrative). A team that flagged Gulf fertiliser supply as "likely" to be disrupted, with a review date, can show the board exactly how early it saw the risk. A team that flagged it as "remote" learns which assumption failed.

11The steps form a system: each output is the next step's input, and the review resets the anchor

Sequence. The dependency map tells Scan where to look, and the four tests decide which clusters Trace follows. Each traced mechanism is what Size ranges and ranks. Each thesis is what Own hands over, and each owned call is what Review scores.

Two shortcuts. A trigger that fires in step 5 moves a risk straight to action, without waiting for the next cycle. And a single signal that clearly threatens a critical dependency can be treated as a cluster of one, if it passes the four tests.

One feedback loop. Review sends two things back to the start. Misses show which dependencies were missing from the map. Retired signals keep the log small enough to read.

Cadence. Scanning runs weekly. Trace, Size and Own run monthly for new clusters. Review runs quarterly, and the dependency map is rebuilt once a year or whenever the business changes shape.

12Six questions show where your emerging risk process is strong and where it breaks

Score each question from 1 (not at all) to 5 (fully, and we can show the evidence).

Reading your score. A total of 6–14 means emerging risk is a list, not a process: start with Anchor and Own. A total of 15–23 means the process exists but leaks: fix the lowest-scoring step first. A total of 24–30 means the process works: the test now is whether it has changed decisions.

The weakest single step matters more than the total. If any step scores 2 or below, read the result as 15–23 at best, and fix that step first.

13The Horizon Loop in action: the 2026 Hormuz closure, seen by a food producer

The case follows one organisation, an illustrative food producer that imports nitrogen fertiliser. The events and figures are real and referenced; the producer and its decisions are illustrative.

1. Anchor. One dependency is imported nitrogen fertiliser for the growing season. Its assumption is that Gulf supply reaches the producer on normal routes and at normal prices.

2. Scan. The first signal came on 22 June 2025, when Iranian state media reported parliament's backing for closing the strait [17]. On its own, a parliamentary vote is a weak signal. It became decisive after US and Israeli strikes on Iran on 28 February 2026. Two days later, an adviser to the commander of Iran's Revolutionary Guards declared the strait closed [2].

3. Trace. Exhibit 3 follows the chain. The oil and gas price moves were the first-order effects, and markets measured them at once [1]. For the producer, the closure arrived two steps later, through fertiliser.

Source: United Nations Conference on Trade and Development (UNCTAD) (2026) [1]; Marine Insight (2026) [2]; UFOQ analysis. Note: the transit fall compares the 1–27 February 2026 daily average with early March. Fertiliser shares are of each country's sea-imported fertiliser from the Persian Gulf in 2024.

4. Size. The thesis states a range for higher input costs, the date by which supply for planting must be secured, and a confidence term. It also asks whether any upside exists, for example for suppliers outside the Gulf.

5. Own. A named person in procurement owns the risk at the "act" level. Triggers include Hormuz transit counts, urea price indices, supplier lead times and export restrictions by producing countries. The first action is to confirm where each supplier's product originates and price alternative supply from outside the Gulf.

6. Review. The call is dated, with a review date. The review would test whether the June 2025 signal, weak on its own, should have been logged against the fertiliser dependency. Had it been, the producer would have had about eight months to act before the closure.

14The Horizon Loop sits on top of ISO 31000 and COSO ERM, so it adds to existing risk management instead of replacing it

Each step maps to a stage organisations already run, as Exhibit 4 shows. The last column is what the Horizon Loop adds. ISO/TS 31050 entries rest on published summaries of the standard [26, 27].

Exhibit 4. Each Horizon Loop step maps to an existing standard and adds one thing it lacks

Source: UFOQ analysis of the sources cited.

15The framework has limits: it finds and frames risks early, but it does not predict events or replace judgement

It does not predict. The Horizon Loop shows where a change would land and how early it can be seen. It did not, and could not, have named the date of the Hormuz closure.

It sees only what the dependency map holds. A risk that reaches the organisation through a dependency nobody listed will be missed. Review exists to catch these misses, but only after the first one.

Truly novel events stay hard. Events with no precedent and no early signals fall outside any scanning method. IRGC notes that its own approach is not designed to anticipate such "unknown unknowns" [9].

Scoring has limits for long horizons. Scoring is easiest when a call resolves by a set date. Many emerging risks resolve slowly or never, so some calls will stay open for years.

It needs time and a named role. The loop is cheap in tools but not in attention. It fails if it depends on one enthusiast.

It has not yet been tested in practice. The framework is built from the standards and research reviewed and illustrated with four past cases. It has not yet been used by organisations over a full year, and this paper will be updated as that evidence comes in.

16Three steps start the loop, using a spreadsheet and the people you already have

1. Write the dependency map. List what must keep working for this year's objectives, with the assumption behind each. Have the business owners confirm it.
2. Run one cycle on one dependency. Pick the dependency that worries you most, scan for signals against it, and trace one cluster through to a register entry with an owner.
3. Set the first review date. Put it in the calendar now, and score the first calls on that date, whatever they turned out to be.

A shared spreadsheet is enough to start. Tools help later, once the volume of signals outgrows it.

17About this paper

How the framework was built. UFOQ reviewed the 22 sources listed below, across four bodies of work. Each was broken down into the same five fields: definition, stages, tools, strengths and gaps. Reading across them gave six practices nearly all sources share, and five gaps that most handle weakly or not at all. Each of the six steps keeps the shared practice and closes one gap.

• Standards: ISO 31000:2018; ISO/TS 31050:2023, with summaries by WTW and Pirani; COSO ERM (2017); COSO, Creating and Protecting Value (2020); COSO, Developing Key Risk Indicators (2010).
• Institutional and regulatory guidance: IRGC emerging risk guidelines (2015) and systemic risk guidelines (2018); World Economic Forum, Global Risks Report 2026; PRA SS19/16; European Insurance and Occupational Pensions Authority (EIOPA), supervisory statement on the own risk and solvency assessment (2017).
• Insurer and market research: CRO Forum, Emerging Risk Radar (2024); Swiss Re Institute, SONAR (2025); Lloyd's systemic risk scenarios (2023–2025).
• Academic research: Ansoff (1975); Hiltunen (2008); Hines and Bishop (2013); Day and Schoemaker (2005); Pescaroli and Alexander (2015); Helbing (2013); Tetlock and colleagues (2014).

What limits the evidence. The full texts of ISO 31000 and ISO/TS 31050 are paywalled. Statements about ISO/TS 31050 rest on its official listing and on published summaries [12, 26, 27]. Some academic sources were read through abstracts and secondary accounts.

Evidence current as of October 2026.