Given the track record in recent years of risk management in preparing for and addressing emerging big risks, it is clear that this is a weaker part of firms' risk management capabilities. How can we better plan for future risk events? In boardrooms and discussions with their chief risk officers, leaders of firms desperately want to know: What should we be worrying about, what is the next thing that is going to blow us up?

A look at major disasters in history: one wrought by God (the biblical flood) and two by man (Hitler's 1940 invasion of France and the 1967 Six‐Day War in Gaza) can provide us with some guiding principles on planning for such events.

First Guiding Principle: Develop Multiple Scenarios and Optionality

Consider the various risk scenarios that require plans to be drawn up to address. In the example of the biblical flood (described in the book of Genesis, chapters 6 to 9), Noah knew exactly how and when the impending catastrophe would unfold. In the complex world of today that is unusual to say the least. There are usually several unknown elements—for example, when an event will take place and how exactly it will manifest.

An interesting case in history is the German invasion of France in the Second World War. France was fearful of a resurgent Germany ever since the harsh terms of the Treaty of Versailles had been imposed on Germany after its defeat in the First World War.¹ The French military planners in the 1930s, expecting an attack, constructed the infamous Maginot Line along its border with Germany as their line of defense. French planners, however, did not want to wall off Belgium and probably did not invest sufficient time in considering the many different ways an attack could come. Instead, they jumped straight to a single solution. Good risk managers tend to devote as much time up front to weighing and deliberating over the various ways an event could manifest itself as to developing solutions to address them. In addition, the likelihood of different scenarios may change and so it is important to constantly revisit and recalibrate each of the key risk scenarios as well as identify new ones if justified by events and information.

In contrast to the France example prior to World War II, the modern state of Israel plans for multiple specific scenarios and always has done so. Surrounded by multiple enemies across all of its borders, Israel has very shallow defense possibilities. The country is geographically very small and so has always been vulnerable to a surprise invasion from a conventional army. Dangerous risk scenarios conceived from the start of its existence included simultaneous attacks from its borders with Egypt, Jordan, and Syria. Such scenarios have in the past two decades been added to unconventional attacks such as suicide bombers and missiles launched at civilian settlements and cities. Nuclear attack from Iran is the latest scenario to be included in Israeli planners' thinking. These are all serious scenarios and highlight the point that risk managers don't necessarily have the luxury to choose which one or two scenarios to prepare for; more often than not, one has to prepare for all of them.²

Second Guiding Principle: Develop Strategies to Match the Scenarios

Noah receives top marks for designing and executing a strategy, albeit with divine assistance, perfectly suited to the scenario he expected. His strategy design was based on the rational conclusion that neither prevention of the upcoming disaster nor saving any of the existing environment were reasonable options and that a mitigation strategy, limited to saving his family (and mankind potentially) and the entire animal kingdom, was all he could reasonably achieve. The ark was perfectly suited to that purpose. The allocation of resources—it did take a hundred years of his life—was well matched to the required investment and potential outcome.

In the case of the Maginot Line, the outcome was not so successful. While the Maginot did successfully prevent a direct attack on France, it ultimately failed since the German army invaded Holland and then Belgium before moving into France. In addition, the almost exclusive allocation of French military spending to the perfection of the Maginot Line defense network resulted in inadequate resourcing of other aspects of France's military infrastructure and strategy. In particular, the new mobile armored vehicles on land and in the air that enabled the German Army to move so quickly through the Low Countries were not matched by French investments in similar hardware. The decisive strike by the German army took them to Paris within the space of five days and enabled them to cut off the main French forces at Maginot and force a quick surrender.

In defense of the French planners, the decision to build the Maginot Line had popular support, and Belgium's neutrality status would not have been considered so lightly violated by the German Army. The critical failure, these factors notwithstanding, was that of neglecting to develop other controls and strategies to contend with an attack other than one on land directly from Germany.

In contrast, having identified the various scenarios, Israel has developed strategies to meet each one. Many of these strategies have required resources and execution capabilities. Most recently, Israel invested in a multiyear program to develop missile defense capabilities, known as the Iron Dome Defense Shield. This strategy appears to have been well suited to the mid‐range missile attack scenario that was directed against it from Gaza in 2012. Official Israel statements in November 2012 indicated that Iron Dome had intercepted 400+ rockets leading one defense reporter at least to write that “the lack of Israeli casualties suggests Iron Dome is the most effective, most‐tested missile shield the world has ever seen.”³

Third Guiding Principle: Understand How the World Is Changing

If one is to prepare adequately for future and emerging risks, one has to mine information and intelligence to ensure that the assumptions behind scenarios and strategies continue to make sense. Noah's information was perfect, of course, and highlighted the continued relevance of his strategy—people were not changing (or at least God's view of them), and so God remained determined to send the flood. In the case of France, intelligence on Hitler's precise intentions was not available to French military planners, who anyway did not necessarily take the new Chancellor (Hitler) at his word. Their belief that a German attack would be launched directly across the Rhine via Alsace and Lorraine did not change, and as a result, their investment francs continued to pour into the Maginot defensive line. There was, however, plenty of data for them to mine. First of all, it was clear from Hitler's actions in Eastern Europe and Sudetenland that he did not respect treaties and sovereignty.⁴ Second, there was much data to show that Germany was investing heavily in mobile armor, planes included, that could enable German forces to rapidly bypass defensive lines. The conclusion that the next war would be fought using different tools and strategies was drawn by at least one of the allies, Great Britain. Britain responded, albeit late, with a similar investment program in mobile resources. French military planners, on the other hand, either did not have data, or if they did, failed to leverage the data in a way that would have allowed them to reevaluate the efficacy of their strategies.

Fourth Guiding Principle: Build Political Will to Resource the Chosen Strategy

Noah failed to build a popular mandate, but his strategy did not require one. In general, however, this is critical. It is unlikely that the French populace would have supported anything other than its chosen “hide behind a wall” strategy, but in any case, French leaders did not seek to convince its people of any alternative.

It is not necessarily the populace that needs convincing in these cases. Israeli military planners, for example, do not need to convince their own population. Rather, it is its key allies that it must work to convince, most especially the United States. Most of the time, the Israelis have been successful in convincing the United States to support its projects. In the case of the Iron Dome, for instance, Israel could not have been successful in its development without the Obama administration's agreement to help fund it and provide vital technical expertise.

The examples discussed here are simply illustrations of the potential danger posed by different risk scenarios. Whatever the specific issue, however, firms need to develop capabilities to peer into the future and think creatively about the risks it may bring and the possible solutions to mitigate those same risks. It is all too easy to focus on the day‐to‐day issues and miss the big risks that are just beyond. There are four steps to avoiding that error:

1. Detail the different scenarios.
2. Design strategies appropriate to these scenarios.
3. Objectively assess the data.
4. Build the political will to undertake the strategies identified.

The fourth step, of course, is the most difficult, and it should start with building a consensus among key decision makers around future scenarios and what strategies make most sense to meet them.