How often do you survey your organization for new, emerging risks? My company currently does quarterly surveys and I am contemplating dropping it down to 2x/year. Appreciate the insights!
Sort by:
The inherent risk of a specific business unit versus the entire organization really depends on your perspective. Additionally, it’s helpful to understand the context: who are you sending these surveys to?
My experience suggests this is quite dynamic, especially with current events constantly changing the landscape. These risk assessments should be ongoing, so formal surveys aren’t always necessary to understand an organization’s risk profile at a specific time. However, a formal quarterly update is generally a good idea, given the rapid pace of change in the industry and beyond. It would be difficult to justify doing less.
We do an annual review of the overall program risks, with monthly review to determine if there is a change in the status. If a risk is identified as emerging or new it can be added. Likewise, if I risk is realized or obsolete, it is addressed with the execution of mitigation plan or removed.
Twice annually, mapping speed of onset and time period for expected realisation.
We dropped from quarterly to 2x/year beginning in 2026 to better distinguish emerging risks vs. risks from the annual Enterprise Risk Assessment.
We started out aiming for quarterly but that seemed too often. 2 - 3 times per year is sufficient. Our minimum is twice per year.