In the early 2000s, Nokia could probably have produced an impressive analysis of the past. Sales trends, market share, production quality, supply chains, brand strength—plenty of data and likely numerous green lights. Nokia was the global market leader in cell phones. Then, in 2007, the iPhone arrived. Suddenly, the primary focus was no longer on who built rugged phones with long battery life. Touchscreens, software, apps, and entire digital ecosystems became the deciding factors. Those who looked mainly in the rearview mirror could enjoy a decidedly reassuring view: The past looked excellent. Unfortunately, the competition was now taking place right in front of the windshield.
This is one of the fundamental difficulties in risk management: risks generally occur in the future. Yet our data comes predominantly from the past. At first, this is unavoidable. Historical loss data, incidents, audit results, and empirical values are important. It only becomes dangerous when "This is what we've observed so far" imperceptibly turns into "That's why it will be exactly the same in the future." The past is a valuable teacher. It does, however, have one small weakness: it doesn't know the future.
This "rearview mirror" perspective is particularly evident in checklists. "Firewall in place?" Check. "Backup tested?" Check. "Emergency plan in place?" Check. "Suppliers assessed?" Check. After twenty checks, a warm feeling of organizational security sets in. But the checklist usually answers a different question: Have we taken into account what we already know? It does not automatically answer the far more uncomfortable question: What could happen that we haven't even thought of yet? The checklist knows yesterday's attack. The attacker may already be working on tomorrow's attack.
This applies far beyond cyber risks. New technologies are changing business models. Geopolitical conflicts are disrupting supply chains. Artificial intelligence creates opportunities and, at the same time, entirely new dependencies. Regulation reshapes markets. New competitors combine technologies in ways not found in any loss database from the past ten years. It is precisely these risks that have a particularly troublesome characteristic: there are often no convenient historical time series available for them yet. Those who look exclusively at the past through a data-driven lens can therefore analyze very precisely why nothing happened yesterday.
Future-oriented risk management therefore requires different questions and different tools. Creativity methods such as pre-mortem, scenario planning, business gaming, or red teaming force us to mentally anticipate possible futures. Horizon scanning and the analysis of weak signals deliberately seek out changes outside the familiar comfort zone. Scenario analyses do not ask, "What has happened so far?" but rather, "What could happen?" And quantitative methods complement these thought experiments: sensitivity analyses reveal critical drivers; stress and reverse-stress tests specifically seek out stress limits; and simulations make visible the ranges within which future developments might fall.
This is not an argument for throwing historical data out the window. On the contrary. The rearview mirror is extremely useful when driving. You just shouldn't spend the entire highway trip looking into it.
Perhaps that is why good risk management needs two perspectives: Learning from the past—and learning from possible futures. The past shows us what mistakes have already been made. Scenarios show us what mistakes we might still be able to avoid.
Because once the boulder labeled "New Scenario" is already lying in the middle of the road, one last glance in the rearview mirror won't do much good. Even if the view from there is outstanding.
