Identifying and responding to unexpected events and emerging threats is a key responsibility for risk management, yet it is one with which many companies continue to struggle. Just 37% of respondents say that their organisation is effective at anticipating and measuring emerging risks. They also find it difficult to react promptly when the unexpected strikes. Only a slim majority of 55% say that their company's risk
strategy enables it to respond quickly to unexpected disasters, such as the Japanese earthquake, and their after-effects. More effective GRC convergence improves this performance. Among those respondents who have fully integrated GRC across oversight functions, 62 percent are able to react quickly to the unexpected and 58% are good at anticipating and measuring emerging risks.

In the wake of the financial crisis, the ability of risk professionals in the banking sector to deal with the unexpected has come under intense scrutiny. As events unfolded following the collapse of Lehman Brothers in September 2008, many institutions found that they were unprepared to deal with the scale of the crisis. Although there is no easy solution to predicting tail risks, or "black swans", ensuring that the organisation is prepared to respond has become a key priority. Regulators have played their part by requiring that banks undergo frequent stress tests to assess the strength of their balance sheet against various pre-determined scenarios. "At the moment, we don't have many ways of estimating tail risk, so stress testing has become an important tool," says Evgueni Ivantsov, Head of Portfolio Risk and Strategy at HSBC. "If it's done properly, we can identify weaknesses in the current business and risk management that we can immediately fix. And we can also come up with a robust contingency plan that can be used if a particular tail risk unfolds."

There are challenges with stress testing, however. First, it can be difficult to choose the right scenarios to test because tail risk inherently involves planning for the highly unexpected. "The problem is that tail risk is largely about unknown unknowns," says Mr Ivantsov.

A second challenge is that, even if the right scenarios are chosen, there is often limited analytical data on which to base them. In the absence of historical data, Mr Ivantsov suggests that banks should instead rely on a more qualitative approach. "When we run scenarios for tail risks for which we have very limited analytical data or experience, we need to focus more on the thought process rather than on number crunching," he explains.

Although financial markets and the global economy have started to recover from the shock of the financial crisis, the debt problems in the euro zone and United States serve as a reminder that unexpected volatility remains a concern. "Complexity and volatility will not come and go," says Mr Ivantsov. "They will stay with us for a long time. This is why we need to combine a robust risk management system to deal with everyday risks with an approach that allows us to react quickly, flexibly and in a non-standard way to tail risk events."