Complexity, Wicked Risks and Professional Service Firms in the Age of AI: How Can Risk Management Respond?

Professional service firms increasingly operate in a risk environment defined by interdependence, uncertainty, rapid change and the emergence of wicked risks. Adapting traditional risk frameworks allows firms to build resilience.

What is a wicked risk and why has the term become common?

How should risk managers respond?

The world of risk has changed, and the geopolitical climate in particular is driving risk escalation and uncertainty about future trends. The World Uncertainty Index was developed by researchers at the IMF and Stanford University. It shows that “uncertainty” has increased by 300% in the past 10 years.

The discussion of how to classify and manage risk has never been livelier. The world is increasingly interconnected, so shifts happen at an accelerated rate. There seems to be a broad consensus that the rules have changed, and we live in a world of “Polycrisis”.

If we look at any current list of “top risks” we can see that multiple connections exist between and within the categories: geopolitical risk, business interruption, cyber security and technology, for example. A single event could be categorized under a number of these headings. Boundaries between categories have broken down.

Some risks have always been complex and interrelated. Historically PI claims can surge in recessions when economic problems translate into financial distress and litigation. So, why are these new conditions prevailing, and what has changed? For one, the manifestations of AI use and the fractured nature of today’s world seem to have changed the nature of risks, their complexity, severity and velocity.

In these conditions, how do we go about defining risks and planning how to manage them?

Risk Definitions and Categories

Identification is the first step. For this purpose, one useful categorization of risk defines three types:

Three significant wicked risk challenges arise for risk management.

• Dependencies are often difficult to identify and map.
• Multiple factors and stakeholders will be involved.
• Data around causes and consequences may be unavailable or non-existent.

If wicked events are thus difficult to define, how can risk managers prepare?

Traditional tools and approaches were designed in a different era but are sufficiently wide in scope to provide a road map.

Complexity Challenge for Risk Management

Traditional risk management teaches us how to identify, define, and prioritize risks as steps in their reduction, elimination or management. This may work with tame and messy risks but do wicked risks defy that process?

Although wicked risks cannot be solved through a traditional linear process, traditional risk management has a framework and tools that can be adapted. Uncertainty and complexity are not new. The basic process remains identical, identifying, assessing and managing risk, followed by consideration of frequency, severity and consequences.

There are numerous challenges of course, including:

• Future hazards may be outside of a conventional narrow risk identification exercise. Past data is potentially less valuable, and some scenario planning must therefore take its place.
  
  
• The interconnectivity of risks must be examined.
  
  
• Future dislocation problems can be created by the dynamic nature of the risks or the actions of regulators as they react to the environment.

A few observations on AI risk may serve to illustrate the wicked risk challenge.

• AI is not a single risk. It overlays existing risks across cyber, professional liability, employment, intellectual property, product liability, and D&O rather than being “standalone”. AI accelerates and amplifies existing risks.
  
  
• Gen AI has changed the landscape as content is generated and several high-profile misuses have emerged in the field of professional services. Processes, quality control, supervision and culture are key management issues.
  
  
• Potential consequences are wide-ranging. Concerns may include bias, job displacement, data privacy and security failures, misinformation, hallucinations and reputation damage.

Risk Management Responses

The basic framework is a good start, but it must be expanded to address a broader horizon.

• Many wicked risks exist at the strategic level, and so ownership clearly resides at the top and strategic risk assessment is the start of the process. Consider, for example, the adoption and use of AI.
  
  
• We have seen the growth of the role of Chief Risk Officer as a strategic reaction to these circumstances. The VUCA acronym (Volatility, Uncertainty, Complexity, Ambiguity) represents a mindset to incorporate into the risk exercise.
  
  
• Suggested complementary tools include PESTEL (Political, Economic, Social, Technological, Environmental, Legal) analysis, systems-based risk mapping, scenario analysis and root cause analysis. Interconnected risks may have similar root causes.
  
  
• There is continuity with, and similarities to, past crises. Lessons exist that can be applied to today’s issues and horizon scanning of current events is instructive.
  
  
• A multiskilled response may be a crucial success factor to build resilience. Operational, political, technological and human factors may all be intertwined.

These measures can be part of the construction of a risk radar that builds insights and intelligence.

Final Thoughts

We are in a world where unexpected change has created significant and widespread disruptions. ISO 31000 defines risk as “the effect of uncertainty on objectives.” The solution to wicked problems is to have a broad appreciation of the risks and a comprehensive strategy.

In this discussion the term Black Swans often emerges. Black Swans are historically considered as outside normal expectations and historical models that have significant impact. The concept was coined by author Nicholas Taleb in 2001 in Fooled by Randomness.

In fact, in today’s conditions some “Black Swans” are now reasonably to be expected and no longer meet the definition of being unforeseeable. Supply chain cyber-attacks spring to mind. Climate change effects and pandemics are two more examples. However, rogue AI and systemic cyber-attacks could meet the test.

In the age of the Polycrisis building resilience against these hazards is vital.

Read more about professional service firms and Enterprise Risk Management.

About Aon

Aon (NYSE: AON) exists to shape decisions for the better — to protect and enrich the lives of people around the world. Through actionable analytic insight, globally integrated Risk Capital and Human Capital expertise, and locally relevant solutions, our colleagues provide clients in over 120 countries with the clarity and confidence to make better risk and people decisions that help protect and grow their businesses.

Follow Aon on LinkedIn, X, Facebook and Instagram. Stay up-to-date by visiting Aon’s newsroom and sign up for news alerts here.

©2026 Aon plc. All rights reserved.

Aon is not a law firm or accounting firm and does not provide legal, financial or tax advice. Any commentary provided is based solely on Aon’s experience as insurance practitioners. We recommend that you consult with your own legal, financial and/or insurance advisors on any commentary provided herein. All descriptions, summaries or highlights of coverage described herein are for general informational purposes only and do not amend, alter or modify the actual terms and conditions of any relevant policy. Coverage is governed only by the terms and conditions of such policy. Insurance coverage in any particular case will depend upon the type of policy in effect, the terms, conditions and exclusions in any such policy, and the facts of each unique situation. No representation is made that any specific insurance coverage would apply in the circumstances outlined herein. Please refer to the individual policy forms for specific coverage details.

The information contained in this document and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity.

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Insurance products and services offered by Aon Risk Insurance Services West, Inc., Aon Risk Services Central, Inc., Aon Risk Services Northeast, Inc., Aon Risk Services Southwest, Inc., and Aon Risk Services, Inc. of Florida and their licensed affiliates.