Disappointingly, the vast majority of companies only make generic references to emerging risks when describing their risk management processes. They provide little insight into whether existing risk management processes were sufficient to identify emerging risks or whether they had to flex or amend these processes to do so. They give little information about how emerging risks, once identified, are treated and monitored.