What FERMA Forum 2026 showed about strategic foresight and why integrated GRC provides the foundation for it.
Rotterdam, October 2026: FERMA Forum 2026 showed that strategic foresight does not require a bigger risk register, but a consistent, connected, and continuously updated decision model. An expert article by Tim-Benjamin Bohmfalk and Andreas Schmitz on the role of integrated GRC as decision-making infrastructure.
Why integrated GRC is becoming decision-making infrastructure
From October 4 to 6, FERMA Forum 2026 brought more than 3,000 risk and insurance management professionals together at Rotterdam Ahoy. Its theme, “Widening the Lens: From Risk Insight to Strategic Foresight,” addressed a key aspect of modern corporate management: Risks need to be not only documented but also understood in context and translated into better decisions.
For CRISAM®, one question took center stage: What methodological and technological prerequisites do companies need to turn scattered risk information into genuine strategic foresight?
The short answer: Strategic foresight does not come from a bigger risk register. It comes from a consistent, connected, and continuously updated decision model.
Risk is not a list, but a system
ISO 31000 defines risk as the “effect of uncertainty on objectives.” This definition matters in practice: A risk is never relevant in isolation, but always in relation to a specific objective, a context, and potential impacts.
In real organizations, these cause-and-effect relationships are rarely linear. A cyber incident, for example, can trigger business interruptions, regulatory obligations, supply problems, financial losses, and reputational damage all at once. Conversely, individual controls can mitigate several risks. Dependencies between sites, suppliers, processes, IT assets, and regulatory requirements create a network in which local events can have system-wide effects.
This is exactly where siloed management systems reach their limits. When enterprise risk management, ISMS, BCM, compliance, internal control system, and audit are kept in separate data sets, the result is different risk languages, redundant assessments, and out-of-sync views of the situation. This not only complicates reporting. Above all, it limits the ability to identify interactions early on.
From hindsight to robust scenarios
Strategic foresight is not a forecast of a supposedly certain future. A scenario-based approach is more scientifically sound: Several plausible developments are considered under explicit assumptions, their potential impacts are assessed, and they are tested for robustness against changing parameters.
A robust risk model therefore needs four properties:
1. Consistent reference objects
Objectives, processes, organizational units, assets, obligations, and controls must be clearly defined and reusable.
2. Mappable dependencies
Cause-and-effect relationships as well as operational, technical, and regulatory links must become visible.
3. Transparent uncertainty
Ranges and distributions often provide a more realistic picture than single point values. Methods such as scenario analysis and Monte Carlo simulation support the quantitative analysis of possible outcomes.
4. Continuous updates
Risks change. Indicators, measures, incidents, and audit findings must therefore feed back into an iterative management cycle.
Decision quality does not come from more data alone. What matters is the relevance, consistency, timeliness, and traceability of the underlying information and assumptions.
Integrated GRC as a shared operating model
Integration does not mean forcing every discipline into an identical process. ERM, information security, business continuity, compliance, data protection, internal control system, and audit have different tasks and methods. However, they draw on many shared objects: business processes, responsibilities, assets, requirements, controls, measures, and evidence.
An integrated GRC model makes systematic use of this overlap. Information is maintained where the subject-matter responsibility lies, but is available to other authorized functions in a consistent context. For example, a single control can be mapped to an operational risk, a regulatory requirement, and an information security objective at the same time. A control deficiency then becomes visible not only as an audit finding, but also in terms of its impact on risks, compliance, and resilience.
This makes the integration of risk management into governance, strategy, planning, and reporting, as emphasized by ISO 31000, technically and organizationally feasible. Parallel registers become a shared management model.
What this means in practice
From the conversations and topics at FERMA Forum 2026, we see three areas for action:
1. Establish a shared risk vocabulary
Terms, rating scales, and responsibilities must be compatible across the organization. Only then can risks from different departments be meaningfully compared, aggregated, and reported to the right audiences.
2. Model dependencies explicitly
Risk management should not stop at likelihood and impact. Companies need transparency about which objectives, processes, resources, and obligations a scenario affects, and which controls are actually effective.
3. Align reports with decisions
A dashboard is valuable when it supports a specific management decision. Good GRC reports therefore show not only the status quo, but also changes, drivers, ranges, the effect of measures, and remaining uncertainty.
How CRISAM® supports strategic foresight
CRISAM® brings risk & resilience, compliance, controls & security, audit & assurance, and reporting together on one platform. Departments keep their specific workflows but work with a connected data model and consistent governance.
This enables companies to:
- link risks, objectives, processes, assets, controls, and measures in a traceable way,
- complement qualitative assessments with quantitative scenarios and simulations,
- reduce duplicate data entry and use information across disciplines,
- visualize impacts and dependencies for each audience,
- document responsibilities, approvals, and changes in an audit-proof manner, and
- generate management reports from a current, consistent data set.
The benefit is not centralization for its own sake. It lies in a reliable overall picture that brings expertise together and improves decision-making under uncertainty.
Conclusion: Widen the lens and connect the data
The theme of FERMA Forum 2026 reaches beyond the event itself. Anyone who wants to widen their view of risk must also overcome the organizational and technological boundaries between GRC disciplines.
Strategic foresight is not a separate add-on project. It is the result of a mature management system: with clear objectives, shared reference objects, transparent assumptions, connected scenarios, and continuous learning.
This is exactly where CRISAM® comes in. The platform creates the shared information base needed to develop well-founded strategic foresight from risk insight, and to turn complex risk data into concrete capacity for action.
Would you like to make the connections in your own GRC landscape visible? Talk to us about your risk scenarios and see CRISAM® in action based on your specific requirements.
Would you like to get to know us?
