Cyber & technology
Consider system downtime, compromised information, AI use and dependence on critical technology suppliers. Ask who owns recovery and how it has been exercised.
See the connections.
Prioritise the consequences.
A practical starting point for risk discussions. These themes are editorial prompts, not a ranking or a diagnostic assessment.
Climate & natural hazards
Identify exposed sites, access routes, utilities and essential suppliers. Distinguish a hazard from your vulnerability and the resulting financial consequence.
Business interruption
Document the processes that must continue, tolerable downtime, available workarounds and recovery dependencies.
Geopolitics & trade
Test concentrated sourcing, cross-border dependencies, sanctions exposure and plausible changes in access to materials or markets.
Liquidity & risk financing
Consider cash flow under disruption, contractual obligations and the distinction between retaining, reducing and transferring a risk.
People & governance
Make risk ownership, escalation and review dates explicit. Consider skills shortages, decision bottlenecks and public trust.
These categories overlap. A severe cyber incident can interrupt operations and weaken cash flow. Avoid adding scenario losses together without considering overlap or dependence.
A REPEATABLE DISCUSSIONTest one scenario →
Identify. Assess. Act. Review.
01
Define the event
Name one outcome, time horizon and accountable owner.
02
Test assumptions
Separate evidence, estimates and uncertainty.
03
Choose a response
Consider avoidance, controls, retention and transfer.
04
Review the result
Set a date, indicator and escalation trigger.
Keep perspectives distinct.
The WEF report considers global risk perceptions. Aon surveys business concerns. NIST describes cybersecurity outcomes. None supplies the event probability for your organisation.
Source: Global Risks Report 2026 → Source: Global Risk Management Survey: key findings → Source: Cybersecurity Framework 2.0 →