How to Turn Weak Signals into Defensible Emerging Risks

Executive summary

An emerging risk should not begin with a risk label. It should begin with evidence.

The evidence is captured as a scan hit. The factual observation is separated from the analyst's interpretation. Related signals are clustered to identify a pattern or driver. The driver is then traced through dependencies to an organizational exposure. Only then is a risk statement written and assessed.

The complete evidence chain is:

Source → observed fact → signal → pattern or driver → causal pathway → exposure → emerging risk → decision

A defensible emerging risk has six characteristics:

1. Traceable — the original evidence can be found and checked.
2. Specific — the observed change is described precisely.
3. Relevant — the change is connected to an objective or exposure.
4. Causal — the pathway between change and consequence is explicit.
5. Uncertainty-aware — facts and inferences are clearly distinguished.
6. Actionable — an owner, indicator, trigger and response posture are defined.

The purpose is not to predict the future. It is to identify plausible changes early enough to investigate, prepare or act.

1. Understand the language before starting

Teams often use news, scan hit, signal, trend and risk interchangeably. That makes the analysis difficult to challenge and almost impossible to audit.

The distinction that matters most is:

A scan hit is something you found. A signal is what the evidence suggests is changing. An emerging risk is how that uncertain change could affect an objective.

2. The framework at a glance

The method contains ten steps.

Methodology 01 — The complete evidence-to-decision pathway.

3. Step 1 — Frame the focal question

Why it matters

Without a focal question, scanning becomes an interesting-news exercise. The team collects large quantities of information but cannot determine what is relevant.

A focal question is not simply a topic such as “artificial intelligence” or “climate risk.” It connects a changing external environment to an objective and a decision horizon.

Use this formula

What emerging changes could materially affect [objective or system] within [time horizon], and what decisions might we need to make?

Define six boundaries

1. Objective — what must be achieved or protected?
2. Domain — what system, activity or value chain is in scope?
3. Geography — where does the analysis apply?
4. Time horizon — how far ahead are we looking?
5. Decision user — who will use the output?
6. Exclusions — what is deliberately outside the exercise?

Running example

What emerging changes in autonomous AI could affect financial control, procurement integrity and supplier management over the next three years, and what preparations should the risk committee consider?

Output

A one-paragraph scope statement that every scanner and reviewer uses.

Common mistake

Writing a question so broad that almost any article qualifies as relevant.

4. Step 2 — Capture the scan hit

Why it matters

An analyst should be able to return to the original evidence months later. A screenshot, copied headline or AI summary is not a sufficient evidence trail.

Minimum scan-hit record

Running example

Scan hit: A software provider announces a controlled pilot in which an AI agent can initiate purchases below an approved value threshold.

Why unusual: Existing procurement systems automate workflows, but the decision to initiate a purchase normally remains with an authorized employee.

Source hierarchy

Prefer, in order:

1. Primary documents, datasets, filings, patents, regulations and official announcements.
2. Credible specialist research and established journalism.
3. Expert interviews and structured observations.
4. Social media, newsletters and commentary as leads requiring verification.

Common mistake

Recording the article's interpretation instead of the underlying fact.

5. Step 3 — Separate fact from interpretation

Why it matters

The most common analytical failure is presenting an inference as if it were directly supported by the source.

Use three separate fields:

Evidence notation

Use a simple visual and written convention:

• Grounded: solid line; directly supported by evidence.
• Inferred: dashed line; analyst interpretation that requires testing.
• Unknown: an explicit gap where more evidence is needed.
• Counter-signal: evidence suggesting the change may not continue or spread.

Running example

It is defensible to say that the pilot delegates limited purchasing authority. It is not yet defensible to say that autonomous procurement will become standard or that the control environment has already failed.

Common mistake

Treating a plausible story as proof of a future outcome.

6. Step 4 — Qualify the signal

Not every scan hit should enter the emerging-risk pipeline.

The five-question signal test

1. What changed? Can the change be stated in one specific sentence?
2. What is different from the baseline? Is it genuinely new, accelerating, weakening or becoming more feasible?
3. Could it persist or spread? Is there a plausible adoption, transmission or feedback mechanism?
4. Why is it relevant? Could it affect an objective, dependency, assumption or control?
5. What would confirm or contradict it? Can the team define the next evidence to watch?

Methodology 02 — The five-question gate for rejecting, watching or accepting a scan hit as a signal.

Classification decision

Do not use a single numerical score

A score can hide weak reasoning. Record short judgments for:

• novelty relative to the baseline;
• source credibility;
• corroboration;
• relevance to the focal question;
• potential reach;
• time horizon; and
• evidence confidence.

Running example

The pilot qualifies as a weak signal because it demonstrates a new capability, changes the location of decision authority, is relevant to existing financial controls, and has observable confirmation indicators.

Common mistake

Rejecting a weak signal because it has not yet appeared in multiple mainstream sources. Limited corroboration is what makes it weak; it does not automatically make it useless.

7. Step 5 — Cluster related signals

Why it matters

One signal rarely justifies an emerging risk. Meaning becomes clearer when different pieces of evidence point toward the same underlying change.

Cluster in two passes

Pass 1 — Structured coverage

Use STEEP or PESTLE categories to check whether the scan is overly concentrated in one domain.

Pass 2 — Natural agenda

Group signals according to themes that emerge from the evidence itself. Do not force every item into a predefined trend list.

Questions for clustering

• Do the signals describe the same behavior, capability or constraint?
• Are they occurring in different sectors or geographies?
• Could one signal enable or accelerate another?
• Do they share an upstream cause?
• Is there evidence moving in the opposite direction?
• Are several weak signals collectively becoming a stronger signal?

Running example

The initial scan hit is combined with signals such as:

• software agents receiving controlled access to payment tools;
• new identity standards for non-human system users;
• insurers asking about autonomous-system controls;
• vendors adding audit logs for agent decisions; and
• regulators consulting on accountability for automated actions.

Together, these signals suggest a broader pattern: AI agents are moving from advising people to executing decisions inside operational systems.

Counter-signal discipline

Actively search for:

• cancelled pilots;
• adoption barriers;
• poor performance;
• restrictive regulation;
• high implementation costs;
• user resistance; and
• evidence that existing controls remain effective.

Common mistake

Clustering signals only because they share a keyword. A useful cluster shares a mechanism or direction of change.

8. Step 6 — Identify the pattern or driver

Pattern versus driver

A pattern describes what appears to be happening across several signals.

A driver explains the deeper force that could sustain or accelerate the pattern.

Driver statement formula

[Underlying force] is enabling or constraining [observable change], increasing the possibility that [future development].

Running example

Pattern: AI agents are moving from recommendation to controlled execution.

Drivers: Falling deployment costs, competition for productivity gains, improved machine identity, and vendor integration with financial and operational systems.

Test the driver

Ask:

1. Does it explain more than one signal?
2. Is there a plausible mechanism linking it to the change?
3. Could it continue over the focal time horizon?
4. What conditions would strengthen or weaken it?
5. Are we describing a driver, or merely renaming the cluster?

Common mistake

Calling a broad topic—such as “technology” or “geopolitics”—a driver. Drivers should describe a directional force.

9. Step 7 — Map the causal pathway and interdependencies

Why it matters

This is where blind spots are found. The direct effect is often manageable; the second- or third-order consequence creates the material exposure.

Build the pathway

Use this structure:

Driver → uncertain development → system change → dependency → organizational exposure → consequence

For every arrow, write the relationship as a verb:

• enables;
• depends on;
• increases demand for;
• constrains;
• substitutes for;
• amplifies;
• transfers;
• concentrates;
• delays; or
• mitigates.

Blind-spot questions

Examine at least eight transmission channels:

1. Supply chain — which upstream or downstream partners are affected?
2. Technology — which platforms, data, infrastructure or vendors are shared?
3. Financial — how could costs, liquidity, insurance or credit transmit the effect?
4. Regulatory — could rules, liability or reporting requirements change?
5. Operational — which processes or controls assume current behavior continues?
6. People — how could skills, incentives, trust or resistance alter the outcome?
7. Reputation — how might stakeholder expectations amplify the consequence?
8. Systemic — could feedback loops, thresholds or concentration effects emerge?

Running example

Falling AI costs enable delegated agent authority → delegated authority allows autonomous transactions → autonomous transactions interact with procurement and payment systems → existing controls depend on a human approver → the accountability gap increases unauthorized-transaction and dispute exposure.

Mark the evidence state of each link

Do not allow a long causal chain to look fully proven when several links are assumptions. Label each link as grounded, inferred or unknown.

Common mistake

Jumping directly from a global trend to a dramatic consequence without showing the transmission mechanism.

10. Step 8 — Formulate the emerging risk

Use an objective-based risk statement

Because of [driver or changing condition], [uncertain development] may affect [objective or exposure], resulting in [consequence].

Running example

Because competitive pressure and falling deployment costs are accelerating the delegation of operational authority to AI agents, machine-initiated transactions may bypass controls designed around human approval, affecting procurement integrity and financial control and resulting in unauthorized commitments, supplier disputes or regulatory scrutiny.

Topic statement versus risk statement

Quality test

A good statement should answer:

• What is changing?
• What remains uncertain?
• Which objective or exposure is affected?
• Through what mechanism?
• What consequence could result?

If the statement cannot answer these questions, return to the causal map.

11. Step 9 — Assess without false precision

Separate impact from evidence confidence

Likelihood estimates are often unreliable for early-stage risks. A low-confidence risk can still justify investigation if its potential impact is high.

Use a two-axis matrix:

Assess five additional attributes

1. Velocity — how quickly could the risk move from signal to impact?
2. Reach — how many objectives, units, markets or stakeholders could be affected?
3. Interconnectedness — could it amplify or combine with other risks?
4. Preparedness gap — how different is the emerging exposure from current controls and capabilities?
5. Reversibility — how difficult would the consequence be to reverse?

Evidence-confidence questions

• Is the source primary and credible?
• Are there independent corroborating signals?
• Are key causal links grounded or inferred?
• Is counterevidence available?
• Are important information gaps explicit?

Running example

The risk may be positioned as high potential impact / low-to-medium evidence confidence. The appropriate posture is investigation and limited preparation—not immediate treatment as a mature principal risk.

Common mistake

Multiplying a speculative likelihood score by an impact score and presenting the result as precision.

12. Step 10 — Define indicators, triggers and response posture

Use three levels of indicators

Define a trigger-action pair

Every trigger must be linked to a predefined action.

Choose a response posture

• Watch — evidence is limited and no immediate preparation is justified.
• Investigate — the potential impact or uncertainty justifies targeted research.
• Prepare — create options, controls, scenarios or contingency plans.
• Act — implement a response now.
• Transfer to ERM — the risk is sufficiently established for normal risk ownership and treatment.
• Retire — the signal has weakened, been absorbed into an existing risk or become irrelevant.

Assign governance

Every priority emerging risk needs:

• an accountable owner;
• a monitoring analyst;
• a review frequency;
• leading, development and materialization indicators;
• trigger thresholds;
• agreed actions; and
• a date for escalation, transfer or retirement review.

13. The complete running example

14. How AI should support the process

AI can reduce scanning effort and improve coverage, but it should not become the untraceable source of the analysis.

Minimum AI controls

1. Retain the original source for every generated claim.
2. Label AI-generated interpretations as hypotheses.
3. Require human verification of material facts.
4. Search deliberately for counterevidence.
5. Prevent the model from assigning risk ownership or approving escalation.
6. Keep evidence confidence separate from model confidence.
7. Log material changes to risk statements and causal assumptions.
8. Use structured fields so that outputs can be compared and audited.

The operating principle

AI for scale and connection. Humans for framing, judgment, decisions and accountability.

15. Practical templates

A. Signal card

Signal ID:
Date captured:
Original source:
Observed fact:
Why this is different from the baseline:
Signal interpretation:
Possible implication:
Relevant objective or dependency:
STEEP category:
Geography:
Time horizon:
Corroborating evidence:
Counterevidence:
Evidence confidence:
Next evidence to watch:
Analyst:

B. Cluster card

Cluster title:
Signals included:
Shared mechanism:
Pattern observed:
Possible driver:
Counter-signals:
Affected systems and stakeholders:
Information gaps:

C. Emerging-risk card

Risk title:
Driver or changing condition:
Uncertain development:
Objective or exposure affected:
Causal pathway:
Potential consequences:
Grounded links:
Inferred links:
Potential impact:
Evidence confidence:
Velocity:
Reach:
Interconnectedness:
Preparedness gap:
Owner:
Response posture:
Leading indicators:
Development indicators:
Materialization indicators:
Triggers and actions:
Next review date:

16. A 30-day implementation plan

Week 1 — Frame and prepare

• Agree the focal question and decision user.
• Define the domain map, objectives, dependencies and exclusions.
• Select diverse primary and exploratory sources.
• Configure the scan-hit template and evidence repository.

Week 2 — Scan and capture

• Run directed and exploratory scans.
• Record observed facts separately from interpretations.
• Apply the five-question signal test.
• Maintain coverage across STEEP domains.

Week 3 — Cluster and connect

• Cluster related signals using a natural agenda.
• Identify patterns, drivers and counter-signals.
• Map causal pathways and interdependencies.
• Invite subject-matter experts to challenge assumptions.

Week 4 — Formulate and decide

• Write emerging-risk statements.
• Assess potential impact and evidence confidence separately.
• Select watch, investigate, prepare or act postures.
• Assign owners, indicators, triggers and review dates.
• Present only the priority set to decision-makers.

17. Quality-assurance checklist

Before an emerging risk is presented, confirm that:

• The focal question and time horizon are clear.
• Every signal links to an original source.
• The observed fact is separated from interpretation.
• The change is different from the current baseline.
• Relevance to an objective or dependency is explicit.
• Related signals have been considered.
• Counter-signals and alternative explanations were sought.
• The driver is directional and supported by more than one signal.
• The causal pathway uses clear relationship verbs.
• Grounded and inferred links are visibly distinguished.
• The risk statement includes change, uncertainty, objective and consequence.
• Potential impact is separate from evidence confidence.
• Velocity, reach, interconnectedness and preparedness were considered.
• An owner, indicator, trigger and response posture are defined.
• The risk has a next review, transfer or retirement date.

18. Recommended exhibits for the designed guide

1. The evidence chain — Source → fact → signal → pattern → pathway → exposure → risk → decision.
2. What each term means — a comparison of news, scan hits, signals, drivers and risks.
3. The five-question signal test — a qualification gate.
4. Fact versus interpretation — grounded, inferred, unknown and counter-signal notation.
5. Signal clustering — multiple weak signals converging into a pattern or driver.
6. Causal pathway and blind spots — direct, second-order and systemic transmission.
7. Risk-statement formula — driver → uncertain development → objective → consequence.
8. Impact versus evidence confidence — the four response postures.
9. Indicator ladder — leading → development → materialization.
10. AI-human operating model — scale and connection versus judgment and accountability.

19. Final takeaway

A weak signal becomes a defensible emerging risk only after the team can show:

what changed, what the evidence supports, what remains inferred, how the change could travel, which objective it could affect, and what decision should follow.

Finding the information is the beginning. Connecting it responsibly is the work.

Method references

• UK Government Office for Science — Futures Toolkit
• UNDP — Horizon Scanning
• UNDP — Future Trends and Signals System
• Houston Foresight — Scanning Process
• ISO — ISO 31000:2018 Risk Management
• HM Treasury — Orange Book: Management of Risk