The historical emphasis of risk management was to recover the financial impact of risk events through insurance and legal arrangements, such as assigning contractual liabilities to retrieve losses from recovery costs, regulatory and customer penalties, and other costs consumed in resolving the effect of disruptions. This reactive style of risk management led to unpredictable costs, impaired financial performance, corporate failures, and ultimately neglected to address the needs and interests of clients and customers. This has become a focal point of risk management as almost every industry has seen widespread disruption caused by the onset of the technology revolution.

In the past 20 years, the world has witnessed an accelerating frequency of severe risk events that have individually caused material harm to the public, the continuing viability of firms, and the safe functioning of critical industry sectors, with severe risk events including the 2001 World Trade Centre terrorist attacks, the 2002 dot-com crash, the 2007/08 financial crisis, the 2011 Fukushima nuclear crisis, the 2020/21 COVID-19 pandemic, and the 2022 cost of living crisis.

Each crisis leads to the same question: how should risk management and resilience standards be reformed to better prepare for the next crisis? This has led to rapid and persistent transformation in risk management and resilience expectations across internal and external firm-wide stakeholders, promoting risk management and resilience as a critical function to firms across every industry.