Risk Experts / Limits

The events that hurt were not on the register

This is a property of the world, not a failure of the method.

Registers are built from what people can imagine, which is drawn from what has happened before, to them or to others they know about. Genuinely novel events are by construction absent, and after each one there is a period of criticism about why it was not identified.

The reasonable response is not to attempt broader imagination, which produces long lists of implausible scenarios that dilute attention. It is to shift some effort from identifying specific events to strengthening general resilience: whether the organisation can operate without a key system, a key supplier, or a key person, regardless of why they became unavailable.

This is the argument for scenario work over enumeration. Asking what happens if we lose access to the building for a month is answerable and useful, and it covers fire, flood, contamination and several things nobody has thought of, without requiring any of them to be predicted.

It also produces a different kind of finding. Enumeration produces treatments for specific risks; resilience work produces dependencies nobody had mapped, which is usually the more valuable output.

The other value of scenario work is that it produces a shared understanding across functions, which enumeration does not. Working through a single realistic disruption with operations, finance, technology and communications in one room surfaces the dependencies between them, and those are precisely the connections a register organised by department cannot represent.