Be it at my risk management seminars, executive roundtables, or board meetings, it never fails. I get this question all too often. How are we supposed to manage the things we don't know or have never experienced? In other words, how are we suppose to manage unknown unknowns?
Let's try to break down this riddle with an example. Imagine we are at the entrance of a beautiful national park. We see a sign. On the sign it says: "Beware of person-hungry bears weighing 500 pounds each. Three have eaten 10 hikers this past year." This depicts a known known risk. We are aware of the potential magnitude of the impact, and the relative likelihood of suffering dire consequences. Deciding whether the hike is worth it becomes much easier with this kind of information.
But let's say the sign said: "Beware of dangerous animals." This is an unknown known. My brain would scan all my knowledge of scary creatures and all the disturbing things they can do. I would think of venomous bites, porcupine quills, skunk smells, rabies, hungry wolves, coyotes and bears. I would have little clue, if they are in the park, or their track record, but their threatening presence is possible. In this instance, I can decide whether to hike in the park based predominantly on what I already knew of the animal planet, courtesy of the Discovery Channel and National Geographic.
Now let's examine what we would do, if there was no sign at all. Do we hike in the park and assume no danger exists? Do we hike in blissful ignorance? Unknown unknowns involve us being unaware of what relevant information is needed to guide us to a better decision. Because you don't know what we need to have, we tend not to seek it. It is also known as the relevance paradox. You don't know what is relevant until it becomes relevant. It would be as though I lived my whole life alone in a box and never experienced an animal. I would not know what I don't know.
With the recent 10-year anniversary of Sept. 11, this paradox seems to have taken center stage again. Often I hear that no one could have even imagined such an event and by default, it was impossible to prevent. Maybe that is true. Maybe I can offer some suggestions as to how to manage risk, even if the information you are getting is limited to the collective awareness and knowledge formed by your team's experience and education.
At the outset, try not to waste good energy worrying too much about what you don't know. Try not to frustrate yourself too much by trying to determine the exact shape, color, origin and date of the next unknown disaster. But, do focus your energy on building strong corporate resumption plans. Do put energy into building sustainable incident management systems with strong communications and extremely well understood problem-solving protocols. Do practice and apply these protocols everyday with known risks like systems failures or inclement weather issues. These are proven systems that work. They aim at putting businesses back on their feet quickly. They build precious corporate resiliency that one day you can capitalize on when that unknown unknown hits.
JOANNA MAKOMASKI is a specialist in innovative enterprise risk management methods and implementation techniques.
October 15, 2011
Copyright 2011© LRP Publications