In the spring of 1961, some of America's brightest foreign policy minds were gathered around the young U.S. President John F. Kennedy. On the table lay the plan for the invasion of the Bay of Pigs in Cuba. The basic idea seemed plausible; many of those involved signaled their approval, and critical assumptions were not scrutinized thoroughly enough. A few days later, the operation turned into a disaster. Social psychologist Irving Janis later cited this case as one of the classic examples of groupthink: Highly qualified people can collectively make surprisingly poor decisions—especially when consensus becomes more important than dissent.
In risk management, we regularly encounter a much more harmless version of this in the conference room. Ten experts are seated around the table. The question is: "How critical is the risk?" Nine or ten green cards are raised. Relief. The result is documented: objectively low. After all, ten experts can't all be wrong.
But they can.
Because ten unanimous opinions do not automatically equate to ten independent pieces of information. Perhaps they've all seen the same presentation. Perhaps they're all using the same historical data. Perhaps the most senior participant spoke first. Perhaps no one wants to explain, just before lunch, why the scenario is actually more complicated. And perhaps one person actually holds up a red card—until someone politely explains that we shouldn't "unnecessarily dramatize" the discussion "right now."
This is how apparent accuracy arises through consensus. A social consensus imperceptibly becomes a risk assessment. Yet nine instances of the same assumption do not suddenly become nine times more evidence. Sometimes ten expert opinions are simply one opinion and nine echoes.
This becomes particularly dangerous in the case of rare, critical scenarios. When an event has never occurred before, the experience of "It's always gone well so far" is of limited help. If everyone uses the same models, data, and thought patterns, everyone may share the same blind spot. That is precisely why disruptive risks, complex interdependencies, and tail scenarios rarely politely stand up and say, "Excuse me, I'd like to be agenda item seven."
Good risk management therefore does not require consensus as quickly as possible, but rather productive dissent. A pre-mortem might ask, "We failed two years from now—what happened?" A red team is allowed to deliberately attack. Assessments can initially be conducted anonymously and independently before discussion begins. A "devil's advocate" is explicitly tasked with dismantling the majority opinion—thinking outside the box in its original, positive sense: deliberately arguing against dominant patterns of thought, questioning assumptions, and allowing for uncomfortable alternatives. Scenario analyses therefore examine not only the most likely outcome, but specifically those developments that are rare, uncomfortable, or even existential threats.
That doesn't mean consensus is worthless. If ten independent analyses using different information and methods arrive at the same result, that's extremely interesting. If, on the other hand, nine people copy the first person's assessment, we haven't measured consensus. We've observed social gravity.
Perhaps that is why, after every unanimous risk assessment, one final question should be asked: "What would have to be true for all of us to be wrong together?"
And perhaps we shouldn't show the person with the red card the door. Instead, we should offer them a cup of coffee first.
