Two thousand years ago, anyone who wanted to know whether a battle, a journey, or a political endeavor would turn out well had an astonishing array of consulting services to choose from. One could observe the flight of birds and deduce the future from it, read the entrails of sacrificed animals, interpret dreams, or simply consult an oracle. The Oracle of Delphi was particularly convenient: You asked a question, received a sufficiently ambiguous answer, and could then interpret virtually any outcome as confirmation. A business model with remarkably robust forecasting quality.
The methods have changed, but the desire behind them has not. Even today, the executive board would like to know: Will the cyberattack happen? When will the most important supplier fail? How much damage will there be? When will the next crisis begin? And occasionally, such questions carry with them the hope that the risk manager might please take a moment to polish his crystal ball and then provide a number with two decimal places. The correct answer, however, is: "I don't know!"
And that is precisely not a weakness of professional risk management, but rather its starting point. A risk manager is not privy to hidden cosmic connections, nor does he intuitively know that the ERP system will go down next Tuesday at 2:37 p.m. His task is different: He systematically examines what could happen. What plausible scenarios exist? What causes could trigger them? What interdependencies amplify their impact? What ranges of possibility exist? And above all: What can we do today to ensure that an unfavorable scenario hurts us less tomorrow?
This is what fundamentally distinguishes scenario analysis from fortune-telling. The fortune-teller says, "I see a storm." The risk manager says, "We know of several possible outcomes. In some, it stays dry; in others, production is shut down for three days; and in a critical scenario, we also lose a major client. Let's consider how we can deal with these possibilities." That sounds less spectacular. But it can then be translated into concrete actions.
Quantitative methods take this idea a step further. A stochastic simulation does not attempt to calculate a single future. It generates thousands or hundreds of thousands of possible futures based on our assumptions and shows which outcomes are common, which are rare, and which are particularly painful. Instead of a crystal ball, we get a distribution. This is less mystical at first glance, but significantly more helpful for decision-making. The key statement isn't: "This is how it will happen." Rather: "This is what we might face—and this is how wide the range could be."
Of course, simulations don't solve the fundamental problem either. Models can be wrong, assumptions can change, and real surprises are often characterized precisely by the fact that they did not appear in the original list of scenarios. That is why forward-looking risk management requires not only data and statistics but also creativity: scenario planning, strategic foresight, predictive analytics, pre-mortems, stress tests, business gaming, red teaming, or simply the uncomfortable question: "What would have to happen for our current worldview to suddenly be wrong?"
Perhaps that is the most important contribution of good risk management: It does not reduce the world's uncertainty. It reduces the surprise when that uncertainty becomes reality. Those who think through possible scenarios in advance, prepare measures, and know their limits will not be all-knowing in an emergency—but they will be significantly less surprised.
The ancient Greeks had the oracle for this. We have data, scenarios, probability distributions, and simulations. Still, we don't have a crystal ball.
Fortunately. Because those who believe they already know the future have usually stopped thinking about alternatives.
