After the 1986 Challenger disaster, physicist Richard Feynman encountered a remarkable range of estimates while working for the investigation commission. Estimates for a catastrophic failure of the Space Shuttle ranged roughly from 1 in 100 to 1 in 100,000. According to Feynman, the extremely optimistic figures came from management, while the much more critical estimates tended to come from the technical staff. Feynman translated the figure of 1 in 100,000 into language that everyone could understand: If a shuttle were launched every single day, statistically one would expect a loss only about once every 300 years. His rather unflattering question, in essence, was: Where does this fantastic belief in the reliability of the technology come from?
It is precisely this ability to translate that is surprisingly often missing in risk management. "We’re 95% sure". Sounds good. 95% sounds like a very decent grade in school. At 99%, someone would probably already be ordering coffee and cake. But here’s the thing: What does that number actually mean? A 5% residual probability can be completely harmless—or that’s exactly where the boulder might be lying that falls through the 95% umbrella. A confidence level, therefore, is not yet management information. It only becomes interesting when we ask: What happens beyond this threshold?
Let’s take a loss distribution. A 95% quantile means, simply put: In 95 out of 100 modeled cases, the loss remains below this value. But in five out of 100 cases, it exceeds it. This single metric doesn’t initially tell us how far above it lies. Maybe a little. Maybe a lot. That’s exactly where the tail risks lie. The situation is similar with the availability of IT systems. "99% available" sounds impressive. However, over the course of a year, this means the systems are allowed to be down for about 87.6 hours—more than three and a half days. 99.9% still means about 8 hours and 46 minutes of downtime, and 99.99% still means about 53 minutes. Suddenly, an abstract percentage has become a question that a production manager can answer: Can we survive three and a half days without this system?
It becomes even clearer in the event of a business interruption. Instead of discussing a "99% confidence level" at the executive board meeting, one could say: "In one out of 100 comparable scenarios, the production shutdown lasts longer than seven days." Or: "With a 5% probability, the loss will exceed 50 million EUR". Or even simpler: "In our critical scenario, ERP and production could be down for a week. Starting on day four, liquidity becomes tight, and we face a scenario that threatens our very existence." Suddenly, no one is discussing statistics anymore. The discussion turns to customers, delivery dates, cash flow, restarting operations, and whether spending 100,000 EUR on an additional BCM measure might not be such a bad investment after all.
That is the true purpose of quantitative risk analysis. It is not meant to hide uncertainty behind an impressive number, but to translate it. A member of the executive board doesn’t have to love the distribution function. But they should understand what the right tail of the distribution means for the company. How many hours of downtime? How many days without the ability to deliver? How many millions in impact on earnings? When does a technical problem become a liquidity problem? And which scenario actually puts the company in trouble?
That's why "95% certain" is possibly one of the most dangerous reassuring statements in risk management. Not because 95% is bad. But because the most interesting question comes right after it: What exactly happens in the other five percent? That’s usually not where the average lies. That’s where the big problem lies.
