Technology and Risk Dependencies

Using technology to identify risk dependencies

Many situations arise from a combination of events or evolve with ongoing or related risks. Risk can range from minor incidents involving one or a few individuals to major crises affecting entire locations such as offices, cities, or countries impacting an entire population. Risks are often interconnected, spreading across multiple areas of an organisation either immediately or over time. It is crucial, both in your response and technology to be adaptive to residual, evolving, or new risks that may arise from the current situation. In daily business operations, your workforce, revenues, production and supply chain are all interconnected, meaning a risk in one area can pose a threat to the others. Identifying, articulating and modelling dependencies between these business areas provides a clearer picture of the overall impact and will determine the appropriate response. Continuously analysing impact also benefits business recovery and informs future mitigation strategies. Businesses with heavy production dependencies across sites face resilience and continuity challenges, these need to be modelled to truly understand the effects of threats. Dependency mapping offers a realistic view of the actual cost and impact of events. Let's look at how technology can be used to identify, articulate and model a wider structure of risk for an organisation.

Identifying and Articulate Risks

Organisations are grappling with the complexities of modelling threats and assessing their impact across their business operations. The ability to map risks, whether cascading, sequential, or branching is critical to understanding vulnerabilities and prioritising responsibilities. However, siloed solutions focused specifically on people, operations, supply chains, finance, infrastructure etc. often hinder a cohesive approach. A robust framework should bridge these walls, integrating departmental roles and responsibilities into a unified strategy while ensuring that resolution outcomes feed back into an adaptive model. Enhancing data points, refining configurations, and improving communication channels are essential for building a scalable and actionable risk model. This is often articulated in traditional risk registers. These suffer from being one dimensional, overly static or simply snapshots of risk at a point in time. Yet, challenges persist, particularly in the taxonomy of risks, where the absence of standardised definitions and categorisations complicates accountability, liability assessments, and regulatory compliance. As enterprises seek to navigate these challenges, the imperative is clear, risk modelling must not only be comprehensive but also continuously evolving to meet the dynamic demands of a volatile global landscape.

Things to consider

• Key is to find technology solutions that allow you to model dependencies into your risk profile

• Using a more dynamic model to learn from experience and evolve beyond traditional static risk registers

• Finding industry expertise to help build these models and learn from other's experience and use cases

Building the models

Effective threat modelling goes beyond surface-level assessments, enabling organisations to uncover hidden vulnerabilities that could disrupt strategic objectives. By identifying where threats originate, who or what they impact, and the depth of their consequences within business operations, enterprises can transition from reactive risk mitigation to proactive resilience. Crucially, this approach connects the dots across disparate areas of the organisation, revealing interdependencies that might otherwise be overlooked. The more recent advent in describing complex situations as poly-crises, where multiple risks branch and intertwine, as seen in incidents like simultaneous power outages across Spain and Portugal, underscores the need for dynamic, interconnected models. Traditional static and simplistic risk registers are no longer sufficient, the focus must shift to understanding how threats evolve, intersect, and escalate over time. Organisations must strike a balance between modelling reality and hope, ensuring their frameworks are not so much theoretical, but actionable roadmaps for navigating complexity in an increasingly unpredictable world. Ai is starting to provide the tools to analyse historic and current situations and aid in predicting potential threats.

Things to consider

• Be open to new ways to articulate risks and their impact on your business if your current model is not sufficiently supporting your efforts

• Look for innovative technology solutions that allow you to model connected threats and test those scenarios

• Think beyond risk registers and understand these fluid dependencies deeper across your business

Technology for Discovery

Artificial intelligence is starting to reshape travel risk management by identifying patterns and previously unnoticed connections between threats. By leveraging AI-driven analytics, organisations can detect connections that might otherwise be overlooked. Deeper analysis remains crucial via real-world testing and use cases to separate meaningful insights from tenuous assumptions. The challenge lies in determining when connected risks become too complex to manage as a single situation, requiring strategic prioritisation to prevent cascading disruptions. Moreover, location-based risks are no longer static, if they ever were. Threats shift dynamically as travellers move between transit hubs, accommodations and meetings, each with its own set of vulnerabilities. While historical data provides valuable lessons, the assumption that past incidents will repeat exactly can be misleading. Any threat you have identified in your traditional risk register, however tenuous could still happen tomorrow. A challenge to AI is how it should balance predictive modelling with adaptability to account for the evolving nature of risk in an unpredictable global environment.

Things to consider

• Look for risk management technologies that analyse a wide range of data sources and can help identify potential dependencies

• Run real-world exercises and test simulations to see how these connected risks actually work and get a better understanding of the impact

• If you read or see other real world examples of connected risks, feed them into your model

Is it Really Possible to Calculate Risk?

Traditional risk matrices that rely on likelihood and severity assessments can fall short when threats are dynamic and could materialise overnight. The challenge lies in articulating risk in a way that is both tangible and actionable moving beyond numerical representations to capture real-world implications for people, operations, revenue streams, and supply chains. A truly effective model requires cross-functional collaboration, ensuring that different teams contribute to risk assessment, mitigation strategies, and the continuous testing of effectiveness. Understanding why and when risks intersect is crucial, particularly in a global environment where disruptions can trigger and cascade unpredictably. Moreover, maintaining a vigilant review of gaps in compliance is essential, preventing regulatory oversights that could compound existing vulnerabilities. The imperative is clear, risk assessment must is an agile approach and deeply integrated across business functions to reflect the realities of an evolving threat landscape. Your technology should help to build this model and articulate impact so that you understand how policy could be shaped and how it is best applied to minimise the impact on your business. Reporting to key stakeholders an leadership teams should represent risk both as a current situation, and an articulation of what has changed.

Things to consider

• Find the best way to articulate the current and changing situation of your risk profile to report to your stakeholders and leadership team

• Simple models such as a risk matrix often hide trending, changing and complex situations

• Look at technology that can adapt and provide you with the tools to adapt how impact is calculated

Building on the shoulders of …

Building a comprehensive travel risk model requires leveraging many sources of data, such as open-source data, national and regional risk registers, risk intelligence agency data etc. to establish a foundational understanding of evolving threats. Organisations should look beyond surface-level assessments and when necessary source specialised research, forecasts, and advisory reports from respected institutions. Examining national emergency response frameworks (such as ICS and JESIP etc.) provides valuable insights into how specific geographical risks are intended to be managed, offering lessons that can inform your strategy. Applying structured analysis models like PESTLE ensures that political, economic, social, technological, legal, and environmental factors are incorporated into risk assessments, while MORTAR adds critical context by framing response efforts around mission objectives, organisational alignment, resource allocation, team coordination, strategic approaches, and operational protocols. Risk intelligence should be sourced from multiple domains to identify known hotspots, whether at national borders, urban centres, or transit hubs that can affect travellers. Additionally, regulation plays a crucial role in shaping organisational responsibilities, threat management, and response processes, reinforcing the need for a flexible and agile approach to mitigating risk in an unpredictable global environment.

Things to consider

• You don’t have to do all the work yourself on day one, lean on what is available and proven and adapt

• For major incidents, your own capability to respond may require help from other partners, emergency services etc. and these need to be included in your model

• Look for industry communities and associations where experience and practice is discussed and shared

Testing the Model Works

Triggering events serve as critical testing points for assessing how response models function in real time, from mobilisation and incident resolution, to long-term business recovery. Selecting incidents to simulate or exercise on that have broad business implications ensures that response efforts remain strategically aligned with operational priorities. Effective mitigation requires cross-functional collaboration, bringing together disparate teams to resolve complex challenges while maintaining continuity. The key lies in establishing meaningful measures that your technology can capture, not just tracking response speed but ensuring actions translate into tangible outcomes that enhance preparedness. As risk landscapes evolve, continuous refinement of the model is essential, integrating lessons learned to improve resilience. This is where your risk technology's ability to model, test and evaluate your approach should pay dividends during an incident or crisis. Additionally, your technology should also model the team roles and responsibilities based on these situations so that your response process is ready to go, ensuring clarity in process, accountability and coordination across departments to optimise success.

Things to consider

• Being able to model connected risks and use technology to turn them into testable and simulated exercises will make your business more resilient

• Using the right technologies to support coordination and collaboration between your response teams and business departments

• Select technology that provides analytics to spot the bottlenecks, pinch-points, blockers, parallels, branch and merging points etc.

Monitoring and Response

Threats may originate from one or multiple sources, ranging from intelligence agencies, automated detection systems or firsthand reports from employees on the ground. Having technology in place to integrate and enact upon these sources is critical for quick response. The ability in the technology to immediately quantify impact when a threat materialises is essential, enabling swift decision-making, crisis team mobilisation, and coordination with external response partners. Escalating efforts across defined business areas ensures that your response strategy aligns with operational priorities, while unforeseen dependencies must be swiftly fed back into the risk model for further refinement. A critical eye should be placed on how your technology (once an incident has been detected) calculates, escalates, triages and notifies your response teams should be part of any selection process and built into your test exercises. Technology and data play a crucial role in connecting risks, defining dependencies and ensuring an adaptable approach to complex and evolving threats. As organisations navigate an increasingly complex risk landscape, leveraging real-world incidents to expand knowledge enhances preparedness, allowing your business to refine response models with every new challenge.

Things to consider

• Ability to quickly evaluate and triage impact and make decisions now and on the foreseeable dependent risks

• Look at case management tools that allow you to combine or separate risks depending on how they need to be managed

• Long term situations may need case management tool to turn response into recovery and projects to resume operations

Inherent and Unforeseen

The scope of impact is often broader than initially anticipated, necessitating your technology solution to be more adaptive with the intelligence data, response processes, teams, communications etc. in real time. In retrospect, or as situations evolve, organisations should assess how well their systems adapt to these shifting threats, refining strategies and configurations to ensure flexibility during change. Once response activities conclude, a structured post-mortem is critical for reassessment, implementation of improvements, and rigorous re-testing turning reactive measures into proactive resilience. Adaptability is key … risk models should evolve to incorporate lessons from unforeseen scenarios, refining response frameworks and team coordination. Testing helps understand the best methods to measure effectiveness to feed back into model improvements. Equally important, is a review of the data sources used, do they provide sufficient depth, or could intelligence be enhanced with additional sources? Organisations that embrace a continuous feedback loop between technology, operational learning and strategic refinement, position themselves to navigate change and complexity with greater confidence, ensuring their risk management frameworks remain robust and responsive.

Things to consider

• You won't model everything that could impact your business, but you can feed situations back into your model when the occur to you or elsewhere

• AI could be a useful ally in helping you look beyond your own predictions, testing your assumptions and overall approach

• Look at technologies that allow you to connect risks and can present these back these possible situations, should it occur again

So …

Different technology solutions handle risk in unique ways. If there's a gap between how you identify, assess, and mitigate threats and the actual alerting and response activities, your ability to adapt and manage these risks can be more challenging. Not all risk solutions offer comprehensive integration across various business areas. However, you might consider solutions that can integrate with other enterprise solutions that may minimise some of these difficulties. Let's delve into some of the key points highlighted in this article.

• To effectively manage travel risk in today's complex and evolving environment, organisations should leverage technology that enables modelling of risk dependencies and their impact. Automation (or through AI) plays a crucial role in real-time assessment, allowing businesses to move beyond traditional static risk models and embrace more adaptive, data-driven strategies.

• Identifying commonalities across risks and understanding their interconnected impact is essential for a more holistic approach to risk management. By analysing how different threats relate and influence one another, organisations can refine response efforts and manage cascading disruptions more effectively.

• Impact measurements should be more than just a retrospective exercise, they should feed directly into improving current risk models. By continuously integrating insights from past and current incidents, response teams can enhance their forecasting, mitigation strategies, and preparedness.

• Risk management cannot be confined to short-lived incidents, businesses should account for ongoing and residual risks that influence the long-term recovery and resilience of their operations. A proactive stance ensures continuity and stability in the face of uncertainty.

• Finally, a well-structured impact model in technology, should be more than a theoretical exercise, it serves as a foundation for driving organisational obligations, accountability, resource allocation, and budget prioritisation. With your technology integrating risk intelligence into decision-making processes, your business can strengthen governance and ensure more confident and sustained operational resilience.