Managing and unthinkable event.

• Author: Barton, Thomas L.
• Position: Enterprise risk management

Two of the greatest risks facing the world at the start of 2009 are the financial crisis and the threat of terrorist attacks. Before each of these risks dramatically and forcefully emerged into the public consciousness, both could have been characterized as high-impact but rare. That is, the effect of the event--if it happened--would be enormous, but the event itself would be unanticipated.

The management of high-impact, rare-event risks is an often overlooked area of enterprise risk management. But it's absolutely critical to the functioning of an effective ERM program. At minimum, such a risk can have a significant impact on an organization; in a worst-case scenario, it can be catastrophic.

A limitation that those implementing ERM programs must confront is captured in the following axiom: "There are knowns, known unknowns and unknown unknowns." The last item--unknown unknowns--are things that we do not know we don't know, and as time passes, we discover more of these unknown unknowns.

It is tempting to view rare events as manageable only in generalized, broad ways. One could characterize the situation with such phrases as: "We'll do something." "Things may happen, but we have more pressing things to worry about." "We can't worry excessively about unknown unknowns or outliers." Such outliers have been labeled in The Black Swan: The Impact of the Highly Improbable, a recent best-selling book by Nassim Nicholas Taleb.

In a sense, the lack of specificity of the pre-knowledge of such events--from how they might happen to whether they will happen at all--engenders a sort of lax, undisciplined way of managing them. Under an ERM framework, however, it is simply unacceptable to chalk such an event up to "not manageable" and focus on the more predictable, tameable and probably less-severe risks.

The risk of costly--possibly ruinous--rare events must be considered in an ERM implementation in meaningful, explicit and disciplined ways. The following examines key difficulties in implementing risk management for such events and overcoming these obstacles.

Worldwide Financial Crisis

It is almost impossible to overstate the severity of the worldwide financial crisis in the second half of 2008. In October, the International Monetary Fund estimated that total losses in the United States for bad loans and securitized assets will likely reach $1.4 trillion, which is almost 10 percent of the U.S. gross domestic product.

There is a view that the financial crisis--while clearly a high-impact; rare-event risk--was unpredictable and possibly unmanageable, an unknown unknown.

But warning signs were available for those willing to consider them: easy home-mortgage credit terms combined with rapidly accelerating home prices and reportedly lax credit standards. Then as home prices stabilized or...