What Is Emerging Risk? Lessons From the Strait of Hormuz Closure

Executive summary

1. Emerging risk is a risk you can see coming but can't yet measure. It's new or changing, with too little history to price or model, but it could have a major impact.
2. Emerging risk is different from normal risk. Normal risk management asks "how much?" Emerging risk asks "is it coming, and would we notice in time?"
3. Emerging risk is cheap to act on early and expensive late. The biggest hits often start outside your sector: the Hormuz closure pushed up fertiliser, freight and insurance costs far from the Gulf.
4. Emerging risk is managed by watching, not pricing. Scan the horizon continuously, and write up every risk with a mechanism, an owner and specific signals to watch.
5. Emerging risk has its own standard. ISO/TS 31050 applies ISO 31000 to emerging risk. It gives you the framework and the language; you still need a practical method.

What is emerging risk?

An emerging risk is one you can see coming but can't yet put a number on.

Sometimes it's genuinely new. More often it's an old risk turning up somewhere unfamiliar. Either way, there isn't enough history to say how likely it is or what it would cost: no loss data, no insurance price, no model.

That isn't the same as unlikely. Usually it just means the thing hasn't happened often enough for anyone to count.

Most organisations work with a definition along these lines: a newly developing or changing risk that is hard to quantify but could have a major impact.

Where emerging risks come from

They tend to come from three places, and plenty come from more than one:

• Something new exists. A technology, a product, a business model. Nobody has seen how it behaves at scale yet.
• Things have become more connected. A failure in one place now travels further and faster than it used to. The hazard is the same; the wiring has changed.
• The world around an old hazard has moved. A new law, a shift in climate, behaviour or politics, and a risk that was always there starts to matter.

The third kind catches people out most often, because nothing about the hazard itself looks any different.

It's a stage, not a category

It helps to think of emerging risk as a stage that every risk passes through, rather than a type of risk.

Something odd happens. Then it happens again. People start to notice, someone gives it a name, and eventually it gets measured and priced. By then it's just another line on the register.

Every risk on your register today went through that process at some point:

• Cyber risk was a niche worry in the mid-1990s. Today it has its own insurance market, its own regulators and its own job titles.
• Asbestos was suspected of causing harm for decades before the costs arrived in force. By 2004, RAND had counted at least 73 companies that went bankrupt after facing large numbers of asbestos claims.

So the useful question isn't only "is this a risk?" It's where the thing sits on that path, and how much time is left before it reaches the end.

Strait of Hormuz: how an emerging risk becomes a real one

The closure of the Strait of Hormuz in 2026 shows that path playing out in real time.

1. It started as a known tail risk. Hormuz has been on every list of shipping chokepoints for decades, and Iran had threatened to close it many times without following through. In the last week of February 2026 it carried 38% of the world's seaborne crude. Most organisations treated a full closure as too unlikely to plan for.
2. Then it became real. After US and Israeli strikes on Iran on 28 February, Iran's Revolutionary Guards declared the strait closed on 2 March. Daily transits fell from a February average of 129 ships to 4 by early March. Between 27 February and 9 March, crude rose 27% and European gas prices 74%. From that point the closure itself wasn't emerging any more: markets were measuring it and pricing it.
3. And it set off new emerging risks. About a third of the world's seaborne fertiliser trade, around 16 million tonnes a year, passes through the strait. Sudan gets 54% of its seaborne fertiliser imports from the Gulf, Sri Lanka 36% and Pakistan 27%. Tanker freight rates, ship fuel and war-risk insurance premiums all jumped. These second- and third-order supply chain risks are the ones that are still hard to measure.

Traced as a chain, it looks like this:

• Event: Iran declares the Strait of Hormuz closed on 2 March 2026.
• First-order impact: tanker traffic collapses; crude rises 27% and European gas 74% in under two weeks.
• Second-order impact: Gulf fertiliser exports stall, and freight rates and war-risk insurance premiums jump.
• Third-order impact: food costs come under pressure in import-dependent countries such as Sudan, Sri Lanka and Pakistan.

The first-order impact was priced within days. The second- and third-order impacts are where the emerging risks sit.

Imagining the closure was never the hard part. Working out where it would land was.

Figures: UNCTAD, Strait of Hormuz Disruptions: Implications for Global Trade and Development, 10 March 2026. We follow these knock-on effects every week in the Weekly Risk Foresight. For more detail, see Insurance closed Hormuz before Iran did.

How is emerging risk different from normal risk?

Ordinary risk management runs on history. Emerging risk doesn't have any yet.

Car accidents make a good contrast. A fleet operator knows roughly how many to expect next year and roughly what they'll cost, so the risk can be priced, insured and budgeted for.

Deepfake fraud was a different story. In early 2024 a finance employee at the engineering firm Arup joined a video call with what looked like the company's CFO and several colleagues, then made 15 transfers worth about $25.6 million. Everyone else on the call was a fake. There was no loss history for that kind of attack, and by the time there's enough data to model it, it will be an ordinary risk that everyone can see.

Both kinds need managing, just not with the same tools. Asking "how much?" about something nobody has measured yet only produces false precision.

Why does emerging risk matter?

When the day job is busy, looking for risks that haven't happened yet can feel like a luxury. The register is full, the audit has been passed, and the board has other things on its agenda.

The trouble is that the big surprises of the last few decades share a pattern: the information was out there, and it wasn't anyone's job to read it. Here are five reasons that matters.

1. It's cheap early and expensive late

Early on you still have choices. You can switch a supplier, renegotiate a contract or hold more stock.

Later, the choices narrow to insurance, if you can still buy it, and crisis management. The closer a risk gets, the less it's worth to have spotted it.

2. Your register is full of yesterday's problems

A risk register records what has already gone wrong somewhere. That makes it accurate, and it also makes it a look backwards.

The next serious problem probably isn't on it. If yours has barely changed in two years, the world has moved on without it.

3. Someone else's event becomes your problem: supply chain risk

The most damaging emerging risks often start well outside your own sector:

• In 2011 the earthquake and tsunami in Japan shut Merck's Onahama plant, then the only source of Xirallic, a pigment used in car paint. Ford had to slow production of vehicles in Tuxedo Black and three shades of red.
• The same year, floods in Thailand put seven major industrial estates under water and knocked out roughly a quarter of the world's hard drive production.
• In 2008, more than 100 English councils had close to £1 billion frozen when Iceland's banks collapsed.

None of these organisations caused its own problem, and most had sensible risk registers for their own industry. The damage came in through supply chain and financial connections they weren't watching.

4. Being ready matters more than being insured

In 1997 two Oxford researchers, Rory Knight and Deborah Pretty, looked at how companies' share prices behaved after catastrophes such as the Piper Alpha disaster and the Lockerbie bombing. Whether a firm was insured made little difference to whether its value recovered. What made the difference was how well management handled the crisis.

That kind of response isn't improvised on the day. It's built long before.

5. The information is usually already there

Look back at almost any of these cases and the facts were public. Market shares were published. Warnings were in the trade press and in research papers.

People didn't miss the information because it was hidden. They missed it because looking for it wasn't part of anyone's job. Emerging risk management makes it part of someone's job.

Emerging risk register example: from headline to risk

Writing "AI is a risk" on a risk register is easy, and it doesn't help anyone. The clearest way to see why is to take one concern and write it up twice.

Before: the headline version

Plenty of registers have an entry like this. It sounds serious, but nobody can act on it. It doesn't say what would happen, to which process, or who is supposed to be watching for what.

After: the emerging risk version

The concern is the same, but the second version names a mechanism, an exposure, an owner and specific things to watch, so someone could start on it tomorrow. Boiled down to one sentence: our payment process assumes a video call proves who someone is, and since the Arup case, that assumption no longer holds.

A live case: fertiliser and the Hormuz closure

The same method works on a live case. Here it is applied to a food producer's fertiliser supply after the Hormuz closure.

Every entry on an emerging risk list should be written up this way. One with no mechanism, no owner and nothing specific to watch is really an observation, and observations rarely lead to action.

Common misconceptions about emerging risks

A few misunderstandings come up again and again.

• "It's just risk management with a new name."
  Risk management works on things that have happened often enough to count. Emerging risk works on things that haven't. The two fit together: emerging risk work finds things early, and normal risk management takes them over once they're concrete enough to own.
• "It's about predicting the future."
  Nobody can do that. A forecast gives you one answer. This gives you a few possibilities and a list of things to watch, so that when something does happen you've already thought about it.
• "It's a list of scary things."
  Only when it's done badly. "AI, climate, war" is a newspaper front page. What turns a topic into a risk is a mechanism, an owner and something specific to watch.
• "Success means being right."
  You'll be wrong most of the time. Most of what you flag won't happen, and that's the price of looking. A smoke alarm that only went off for real fires would be a remarkable machine. The goal is to avoid being surprised, not to keep a high hit rate.
• "Compliance and insurance already cover it."
  Regulations are written about risks somebody already understands, which means those risks are no longer emerging. Rules set a minimum; they won't warn you about what's next. And insurers tend to avoid covering what they can't price.
• "We need better data, or a platform, first."
  In almost every case in this article, the information was already public. The gap is usually ownership, not data. A shared spreadsheet is fine until you have a few hundred items or more than about five contributors, and more programmes drown in information than starve for it.
• "We had a near miss and nothing broke, so we're fine."
  This is the most dangerous one. Thailand had serious floods in 2010, but they mostly hit other parts of the country, and it was easy to conclude the industrial heartland was safe. A year later, the 2011 Thailand floods put seven of its biggest industrial estates under water. A near miss doesn't prove you have a control. It may only prove you were lucky.

When do you need an emerging risk approach?

You probably need one if any of these sound familiar:

• Your business has changed shape recently: a new market, supplier, technology or regulation
• You rely on very few suppliers, one site or one critical system
• Something from outside your sector is reshaping it
• Surprises keep happening, and "nobody could have seen that" keeps getting said
• A competitor was hit by something you can't explain
• You're about to commit to something large that would be hard to undo

The most telling sign is simpler: your risk register looks much the same as it did two years ago, even though the world doesn't.

If the answer is no, the register isn't wrong. It's just looking backwards, and nothing in your process is pointing it forwards.

ISO 31050 and ISO 31000: what the standards say about emerging risk

ISO 31000 is the main international standard for risk management. ISO/TS 31050:2023, Risk management — Guidelines for managing an emerging risk to enhance resilience, was published in October 2023 to show how ISO 31000 applies to risks you can't yet measure.

It's worth knowing what kind of document it is. A Technical Specification is guidance issued while a subject is still developing, not a settled requirement. The full text sits behind ISO's paywall, so what follows is based on published summaries; if you need to cite it formally, buy the document.

The types of emerging risk it names

• Risks created by innovation
• Risks created by technological development
• Risks tied to unrecognised risk sources
• Risks arising from modified services

What it says about the nature of emerging risk

This is the most practical part of the document, because it's candid about what you're up against.

1. You often can't know the basics

For emerging risks it is frequently impossible to know the chance of the risk occurring, what the consequences would be, or even how to describe the early scenario.

2. Weak signals matter more than incidents

The standard stresses paying attention to faint, early signs instead of waiting for incidents. It also warns that interpretation bias shapes how people read those signs.

3. System effects matter

Small changes can cascade through interdependencies and cause effects out of proportion to their cause. The damage travels through connections, not through the original event.

The horizon scanning loop

This is horizon scanning, and the standard treats it as a cycle that keeps running rather than an annual review. It has four steps:

1. Frame the issue in the right context.
2. Collect and analyse relevant information.
3. Interpret why the change is happening.
4. Communicate findings to decision makers.

What comes out of the loop feeds the usual ISO 31000 process: set the scope, context and criteria, assess the risk, decide on treatments, then monitor and review. Communication and consultation are meant to run through all of it rather than come at the end.

The eight principles

How to use it in practice

What the standard gives you is credibility, a shared vocabulary, a governance structure, and a ready answer when a board member or auditor asks whether there's a standard for this.

What it doesn't give you is a method. It describes what good looks like without saying how to get there. There's nothing on building a baseline view of the future, no scenario technique, and no guidance on tracing an event across sectors.

So use ISO/TS 31050 for the framework and the language, and pair it with a practical method that does the actual work.

Five tests of a good emerging risk programme

To finish, here are five questions that turn the standard and the lessons above into a quick check of your own programme.

1. Do you scan the horizon continuously, or once a year?
   A report that's read once and filed does nothing. If scanning stops between annual reviews, so does your early warning.
2. Do you act on weak signals, and question how you read them?
   Waiting for incidents means waiting too long. Look for faint early signs, and ask whether your team is reading them through its own assumptions.
3. Do you trace effects across sectors?
   Ford, the hard drive makers and the English councils were all hit by something that started outside their industry. A process that only looks inside your own sector will miss the risks most likely to hurt you.
4. Does every item have a mechanism, an owner and something to watch?
   An item without an owner tends to stay an observation. It's the most common reason emerging risk programmes stall.
5. Do your findings change decisions?
   The standard's loop ends with getting findings to decision makers. A simple test: has your risk register changed in the last year, and did anything you flagged lead to action?

If you can honestly answer yes to all five, you're ahead of most organisations.

How to present emerging risks to the board

Finding an emerging risk is half the job. The other half is getting leadership to act on it while it's still cheap. Three things help:

• Use the format they already approve. Write emerging risks in the same fields as your existing risk register: owner, mechanism, exposure, signals. The board then only has to absorb the new content, not a new format as well.
• Give ranges and triggers, not precise numbers. A confident figure for something nobody can measure undermines you. Say what would have to happen for the risk to become real, which signals would show it coming, and what you'd do then.
• Keep it to three to five items, each with a clear ask. For every item, say which decision you need: keep watching, prepare a response, or act now. People who skim the paper should still know what you want from them.

Conclusion

Emerging risk work isn't an academic exercise or a list of headlines. Done properly, it buys time: time to change a supplier, rewrite a process or rethink a commitment while that's still cheap.

It won't make you right about the future. What it does is make sure that when something happens, you've already thought about it, someone owns it, and you know the first thing to do.

The principles are the same for a global group and a growing business. Write down what you depend on, watch for what could break it, give every risk a mechanism and an owner, and keep looking.

Put simply, emerging risk management is how you prepare for things you can't yet measure, because by the time you can measure them, most of the value of preparing has gone.

UFOQ traces major events like the Hormuz closure through their first-, second- and third-order impacts every week. Read the latest Weekly Risk Foresight.

Want to learn more about emerging risk?

Standards

• ISO/TS 31050:2023 — Risk management — Guidelines for managing an emerging risk to enhance resilience
• ISO 31000:2018 — Risk management — Guidelines

Free emerging risk publications worth subscribing to

• Swiss Re SONAR — annual emerging risk report
• CRO Forum Emerging Risk Initiative — radar and definitions
• Lloyd's Futureset — emerging and systemic risk scenarios
• World Economic Forum Global Risks Report — annual

Method

• Hines, A. & Bishop, P. (2013), Framework foresight: Exploring futures the Houston way, Futures 51

Frequently asked questions

Q: What is an emerging risk?

A: A newly developing or changing risk that is hard to quantify but could have a major impact. It's a risk you can see coming but can't yet measure, because it hasn't happened often enough to produce data.

Q: Is the Strait of Hormuz closure an emerging risk?

A: The closure itself stopped being emerging in March 2026, when it happened and markets priced it. What is emerging now are its knock-on effects: fertiliser and food costs, freight and marine insurance. Those are still hard to measure, which is exactly what makes them emerging risks.

Q: How is emerging risk different from normal risk?

A: Normal risk asks how much? and answers with history, models and insurance. Emerging risk asks is it coming, and would we notice in time? It is managed by watching and preparing, not by pricing.

Q: What is a risk register?

A: A risk register is a list of an organisation's known risks, each with a rating, an owner and actions. It is built from history, so it tends to miss emerging risks until they have happened somewhere.

Q: How is it different from strategic foresight or scenario planning?

A: Foresight looks at the whole future, good and bad, usually two or more years out. Emerging risk looks only at the downside, and usually closer in. The tools overlap, but the focus is narrower.

Q: What is horizon scanning?

A: Horizon scanning is the regular search for early, weak signals of change that could affect an organisation. It is how emerging risks are found before they reach the risk register.

Q: What are emerging risks in insurance?

A: For insurers, emerging risks are exposures that policies may already cover but that cannot yet be priced, such as new technologies or shifting climate patterns. With little loss data, insurers watch and limit exposure rather than price it.

Q: Who should own emerging risk?

A: Usually the risk function, but it only works if people outside risk are involved too: operations, strategy, procurement. The point is to look across boundaries, and a single department can't do that alone.

Q: Where do we start?

A: Not with a list of risks. Start with a list of what you depend on: suppliers, customers, rules, places, systems, money and people. You can't predict every bad thing, but you can write down everything you rely on. Anything that hits one of those will then show up by itself.

Q: How far ahead should we look?

A: Far enough that you could still act, close enough that people take it seriously. For most businesses that's one to three years. Much beyond five years, it gets hard to hold anyone's attention.

Q: What does it cost?

A: It can cost almost nothing. Public sources cover most of it. Buying software first is the classic mistake: it gives you volume without judgement, and judgement is the scarce part.

Q: How do we know it's working?

A: Measure three things: are we spotting things earlier than we used to, has our risk register actually changed in the last year, and when something did happen, had we thought about it before? The last one is the real test.

Q: How do we prove the value to the board?

A: Don't try to prove avoided losses; you can't, and the attempt looks weak. Show what you flagged before it became obvious, how much earlier you could have reacted, and what it cost to find out. Treat early warning as something you paid for, and show what it bought.

Q: Nobody could have predicted [recent disaster]. Doesn't that prove this doesn't work?

A: Usually somebody did, just not somebody whose job it was to say so. You often can't predict the event. You can spot the weak spot it would land on. That's a smaller claim, but an honest one.

Q: How do we get people to take part without it becoming blame?

A: Make it structural, not personal. Saying "our biggest supplier is a problem" can sound like criticism of whoever chose that supplier. But in most real cases nobody did anything wrong; the hazard came from outside the box they were looking in. It helps to say so early, and to keep saying it.

Q: Why do emerging risk programmes fail?

A: No owner. Something gets spotted, written down and discussed, and then nobody's name is next to it, so nothing happens.

Sources

• UNCTAD, Strait of Hormuz Disruptions: Implications for Global Trade and Development, 10 March 2026
• Marine Insight, Iran's IRGC declares Strait of Hormuz closed, 2 March 2026
• Xirallic (Wikipedia) and CarTrade, Carmakers facing paint shortage, 2011
• eWeek, Flooding in Thailand disrupting HDD manufacturing, October 2011, and 2011 Thailand floods (Wikipedia)
• Kent County Council, Update on Icelandic deposits, November 2009 (LGA figures: 125 English authorities, £932m)
• Building, Masters of disaster (summary of Knight and Pretty, 1997)
• Insurance Journal, RAND study of asbestos litigation, May 2005
• AI Incident Database, Deepfake CFO scam at Arup
• ISO, ISO/TS 31050:2023 listing