NOW: A New Approach to Risk Management

Traditional risk management approaches in the public sector have often relied on periodic assessments that capture a snapshot of the risk landscape at a single point in time. While valuable, these approaches can struggle to keep pace with rapidly evolving threats and opportunities, leaving organisations vulnerable to risks that emerge between assessment cycles. The NOW methodology represents an innovative response to this limitation, offering a framework for continuous, real-time risk assessment that enables organisations to identify and respond to emerging risks as they develop rather than discovering them after they have materialised.

At its core, the NOW approach integrates three elements that traditional risk management frameworks often treat separately: continuous monitoring of risk indicators, collaborative risk assessment involving stakeholders across the organisation, and forward-looking scenario analysis that anticipates how the risk landscape may evolve. By combining these elements into a single, dynamic framework, the NOW methodology provides decision-makers with a more timely and comprehensive understanding of the risks facing their organisations, enabling more agile and effective responses.

For auditors, the NOW methodology offers both opportunities and challenges. On the opportunity side, organisations that implement effective real-time risk management are likely to have stronger control environments and more mature governance frameworks, which can make audit engagements more efficient and productive. Auditors can also use the data generated by continuous risk monitoring systems as audit evidence, supplementing traditional audit procedures with real-time risk intelligence. On the challenge side, auditing a dynamic, continuously evolving risk management system requires different skills and approaches than evaluating a static, periodic risk assessment.

The OECD Auditors Alliance has facilitated the sharing of experiences with the NOW methodology and similar real-time risk management approaches across member countries. These discussions have highlighted the importance of technological infrastructure, organisational culture, and leadership commitment in making continuous risk management work in practice, and have identified practical lessons for both implementing organisations and their auditors.