The Known Unknowns

While serving as US Secretary of Defense under President George W. Bush shortly after the September 11, 2001 terrorist attacks, Donald Rumsfeld’s regular briefings on the progress against the “War on Terrorism” were informative as well as entertaining to a viewing public the world over. At one such press conference, on February 12, 2002, Mr. Rumsfeld was responding to a reporter’s question about the limitations of intelligence reports, when he said: "There are known knowns. There are things we know we know. We also know there are known unknowns. That is to say, we know there are some things we do not know. But there are also unknown unknowns, the ones we don't know we don't know."

As a financial and risk executive working for multi-billion-dollar companies in Europe and the US, I would often hear Mr. Rumsfeld’s words echoing in my ears as we approached complex corporate projects and also as we witnessed occasional control failures within our business. As a corporate risk manager, if I failed to prevent a negative outcome within my organization, it was easy to feel that I failed in my accountability, as these were “known knowns” and (theoretically) should have been somehow preventable.

But beyond the “knowns”, there were also the “known unknowns”- which often come in the form of what the risk management community calls ‘External Risks’. ‘External Risks’ come from outside the company- from conditions or events that you know exist but that you can't directly influence or control as a manager. A few obvious examples of External Risks are extreme weather events and natural disasters, terrorist attacks, political and regulatory risks, and infectious diseases- with the prominent example of the recent COVID-19 pandemic. All have destructive potential to your business, and all are outside of your sphere of control.

The main problem in my view in dealing with External Risks, is that their probability of likelihood and level of impact are notably difficult to predict, and therefore the pendulum swings between doing too little and being heavily-exposed to External Risks, or doing too much and spending lots of money to prepare for something that may never happen. Think of it like buying and installing a home generator- it will cost you thousands of dollars to install a system that -if you’re lucky- you may never use. On the other hand, if there’s a prolonged blackout over a number of weeks, you may be the most envied house in the neighborhood. What’s the right balance? It’s entirely up to you- and defined by your ‘risk appetite’- how averse you are to the impact of a risk event. (Using the example of our home generator decision, if you have a family member whose health is dependent on specialized electric-powered medical equipment, your risk appetite is probably quite low and you’d buy the generator.)

At this point, if you are feeling overwhelmed by the challenge that External Risks pose to your company, please don’t! Keep in mind that no one can foresee the future- we can only prepare for risks as best we can; based on the imperfect information that we have. Even the world’s ‘risk elite’ are surprised from time-to-time. Let me illustrate with a very recent example.

I’ve been an avid reader of the “Global Risk Report”, released each year in mid-January by the World Economic Forum (WEF) in association with their strategic partners at Marsh & McLennan, Zurich Insurance Group, and with academic advisors from Oxford, Wharton, and the National University of Singapore. It’s a very readable and high-quality “multistakeholder” report with deep insights and is produced by many notable and formidable data scientists and subject matter experts from across the world. As a corporate risk manager, I looked to the WEF report each year to sense-check if I’d missed or neglected any big themes in my own risk management planning.

Big themes like a global pandemic, perhaps?

The WEF report was issued on 15 January 2020, and listed the top-five Global Risks (in terms of likelihood) as: Extreme Weather; Climate Action Failure; Natural Disasters; Biodiversity Loss; and Human-made environmental disasters.

In terms of Impact to the global community, every one of the WEF ‘top-five’ 2020 Global Risks fell into the category of “Environmental” risks- with no mention of infectious diseases or pandemics at all. In fact, the WEF report had only listed “infectious diseases” or “pandemic” as top-five Global Risks in 2015 and 2008. “Economic” Global Risks had likewise not made the top-five in either impact or likelihood since 2016, when “Energy Price Shock” appeared on the list.

One month after the release of the WEF report, the first US-based COVID-19 deaths were recorded on the US West Coast. At the time of my writing, over 27 million Americans have been infected with the COVID-19 virus, and nearly 500 thousand have died. According to the World Bank, COVID-19 “is expected to plunge most countries into recession in 2020”, with “advanced economies projected to shrink 7 percent.” The UN estimates that four years of global economic gains have been wiped out by COVID-19, with output estimated to fall $8.5 trillion dollars from 2020 to 2022. And this is likely optimistic.

So while the WEF report isn’t encouraging in terms of our collective predictive abilities around External Risks, shall we throw our hands up in the air and surrender to our fate? Certainly not! Although you can't prevent or predict the exact impacts of all external risks to your business, you can, and you must PREPARE for the ones that are most likely.

Preparation differs from Prevention in the same way that checking the air pressure in your car’s tires before a long trip doesn’t prevent you from running over a nail and getting a flat out on the road. You help Prevent a flat by checking the tire pressure before you leave home, but you Prepare for the flat ‘event’ itself by having a spare on hand, or (if you’re like me) by being a member of AAA and having someone to call for help. Prevention tries to stop the bad event from happening at all, whereas Preparation helps you respond to the bad event, should it happen. Both are critical, and both require specific analysis and countermeasures.

At AscentWorks Partners, we know that business continuity is a common and important objective of our clients. Our experts can help you identify the key sources of external risk for your company, assist you in scenario assessment of impact and likelihood, and help you develop an appropriate response plan to prepare for your most prominent risk scenarios. Call us for a consultation and feel better about your readiness to face external challenges.

Questions for Thought

· What external risks do you feel can impact your business?

· Is your company prepared for natural disasters or extreme weather events, in the area that you operate? Do you have a robust Business Continuity Plan (BCP) in place?

· Do you have any Key Risk Indicators (KRIs) in place that would help you to monitor changes in the external environment that could impact your strategic objectives?


You may have noticed that I didn’t cover the “unknown unknowns” above- so let me touch on these before you think I have ‘fear of the unknown’!

“Unknown unknowns” aren’t formally identified in the risk management world, other than being acknowledged as ‘unidentified risks’. These are risks that we can't realistically prevent or prepare for, as we don’t know that they exist at all. An example of this could be how makers of digital cameras, alarm clocks, address books, and hand-held audio recorders were unprepared for the launch of the iPhone- an innovation that came straight out of the blue. These types of risks are statistical ‘extreme outliers’ and therefore rightly earn their name- “unknowns”! We must simply learn to live with these.

You may have also heard of “Black Swan” risks: this is a term coined by author Nassim Taleb for a type of risk event that is an outlier (it is rare), is hard-to-predict with usual scientific methods, and that has severe consequences which experts -in hindsight- will agree should have been predictable. Examples of ‘Black Swan’ events were the 9/11 terrorist attacks and the 2008 global financial crisis.

So was the COVID-19 pandemic a “Black Swan” event, or an “unknown unknown”? Actually neither. As I mentioned above, the risk of a pandemic was fully known and recognized by the world political, corporate, and risk management communities and documented in the WEF report- it was simply not taken seriously enough by decision makers, until it had manifested itself strongly in terms of death rate. Nassim Taleb himself (with co authors Norman and Bar-Yam) published an open letter in January 2020, which outlined the potential of nonlinear “fat tailed” spreading of the COVID-19 disease due to increased global connectivity, thereby “making conventional risk-management approaches inadequate”. Taleb et al called for, among other things, “multiscale population approaches including drastically pruning contact networks using collective boundaries and social behavior change, and community self-monitoring.” In hindsight, this was some particularly good foresight.

Bibliography and Recommended Reading

Rumsfeld's Knowns and Unknowns: The Intellectual History of a Quip. David A. Graham. March 27, 2014.

Taleb, N.N. (2007). The Black Swan: The impact of the highly improbable. Random House: New York.

COVID-19 to slash global economic output by $8.5 trillion over next two years. 13 May 2020. UN Department of Economics and Social Affairs.

The Pandemic Isn’t a Black Swan but a Portent of a More Fragile Global System. Bernard Avishai. April 21, 2020.

Joseph Norman, Yaneer Bar-Yam, and Nassim Nicholas Taleb, Systemic risk of pandemic via novel pathogens – Coronavirus: A note. New England Complex Systems Institute (January 26, 2020).

Open Document

For Thought

For Thought