In the aftermath of Superstorm Sandy¹ in 2012, various articles pointed out the gap between the size of the storm's surge and the magnitude of such an outlying event planned for by New York City and coastal New Jersey. What was expected was much smaller than what was delivered by nature. For business continuity plans and overall infrastructure, the storm aftermath led to the question of whether said plans were effective, given existing storm data and forecasted trends for potential future storms. How do we plan more effectively for such events in the future? Scenario analysis offers one useful approach.

Industry and its infrastructure have, of course, always been vulnerable to catastrophes, both manmade and nature‐based. The impacts of terrorism, earthquakes, and fraud have all impacted industry in the past decade. The problem of determining the likelihood and impact of a terrorist attack, a large oil spill, or a massive hurricane like Sandy is inherently hard to solve for. However, it is a critical step to take if one is to appropriately address each type of risk. Overestimating the size and frequency of future events can result in wasted resources. Yet, natural inertia, ingrained optimism, and pressure of the day to day can lead to a fatal failure for disaster planning to keep up with the level of potential danger as it ebbs and flows. In reviewing many business continuity plans of firms impacted by Superstorm Sandy, it is clear that this is what happened in this case.

There is clearly a need to strike the right balance between wasted resources and much‐needed investment in preventive or mitigating systems. One useful tool developed to address this issue is risk scenario planning. In broad terms, such planning assesses alternate scenarios of how things could go very badly wrong in the future. These scenarios are subject to discussion and dialogue between subject matter experts and organization budget managers in a workshop setting. Data are brought to the table to frame the discussion, including case studies of past events and their associated impacts. While having a good understanding of what happened in the past is critical, it is not sufficient for imagining, in the context of a dynamic, constantly changing system, what could go wrong in the future. A more accurate forecast depends on an honest appraisal of the effectiveness of those things put in place to prevent or to mitigate future events—and ideally, other information that sheds light on the current likelihood or impact of future events. In the context of volatile weather, this could be broad trends on ocean levels, size and frequency of hurricanes potentially in the path of the city, and the strength of safeguards put in place to prevent or mitigate the damage to a firm's physical and network infrastructure.

The real power of scenario planning is based on two somewhat qualitative and behavioral aspects. First, taking leaders and subject matter experts away from the day‐to‐day exigencies of their work allows them to focus on those risks that have the power to take away their work on a permanent basis.

Second, giving space and opportunity for the imagination to crawl through the data, visualize real scenarios that could happen, and honestly evaluate those things that have been put in place to prevent or mitigate such events is surprisingly underestimated as a management tool. The absence of that opportunity can lead to an absence of imagination that is potentially fatal for the business. With the key leaders in the room, decisions can be made on the spot to shift resources and focus accountability for addressing the “top risks” that face the organization in more effective ways. This has helped organizations that use this tool to improve their level of preparedness quite significantly.

Hurricanes Katrina and Sandy wrought incredible human and physical damage to two major US cities and their associated businesses and infrastructure. Other natural disasters have occurred in other parts of the world, such that it is appropriate to take a step back and review risk levels and mitigation plans. To help do so, financial firms should utilize tools that can help evaluate the received wisdom regarding so‐called black swan, once‐in‐a‐lifetime weather events. Given the arrival of two, maybe three such events on US eastern shores in the past decade, the time to do so is long overdue. Scenario planning workshops facilitated with the most senior leaders of the firm and even their partners in government could help our firms to better prepare for such events in the future.