erm

Unknown-Unknowns

Risks an organization is completely unaware of, whose nature and probability are unforeseeable. Often termed "black swan" events, they can have catastrophic impacts. Managing them, guided by ISO 31000 principles on uncertainty, focuses on building organizational resilience and adaptability rather than prediction.

Curated by Winners Consulting Services Co., Ltd.

Questions & Answers

What is Unknown-Unknowns?

Coined in the context of intelligence gaps, "Unknown-Unknowns" refers to risks we "do not know we do not know." In risk management, they represent the ultimate blind spot. Unlike "Known-Unknowns" (e.g., we know interest rates will fluctuate, but not by how much), these are threats we haven't even conceived of. The initial global supply chain impact of COVID-19 was an unknown-unknown for most businesses in late 2019. While not explicitly named, the concept is central to ISO 31000:2018 (Risk management — Guidelines), which mandates a comprehensive risk identification process considering changes in the "external and internal context" (Clause 5.4.1) and managing the effects of "uncertainty." Similarly, NIST SP 800-30 emphasizes assessing uncertainty in risk sources. Therefore, managing these risks is not about prediction but about building an organization that can rapidly detect, respond to, recover from, and learn from unforeseen events, enhancing overall resilience.

How is Unknown-Unknowns applied in enterprise risk management?

While one cannot directly "manage" an unknown risk, an organization can prepare for its consequences. Practical application involves three key steps: 1. Horizon Scanning: Systematically scanning the external environment (technological, political, social) for "weak signals" of disruptive change. 2. Scenario Planning: Developing several plausible, internally consistent, yet fundamentally different futures to test the robustness of current strategies. Shell has famously used this since the 1970s to navigate oil crises. 3. Stress Testing & Red Teaming: Simulating extreme but plausible negative events (e.g., failure of a critical supplier, major cyber-attack) to assess response capabilities. The stress tests mandated for banks under the Basel Accords are a prime example. The measurable outcome is not a reduction in risk events but a significant increase in organizational resilience, improving long-term survival rates during major crises.

What challenges do Taiwan enterprises face when implementing Unknown-Unknowns?

Taiwan enterprises face several challenges in addressing Unknown-Unknowns: 1. Conservative Corporate Culture: Many firms, especially in traditional manufacturing, favor risk aversion over exploring uncertainty, showing reluctance towards speculative methods like scenario planning. 2. Resource Constraints: Small and medium-sized enterprises (SMEs), which form the backbone of Taiwan's economy, often lack the dedicated personnel and budget for strategic foresight teams. 3. Short-Term Performance Pressure: A focus on quarterly results discourages investment in preparing for low-probability, high-impact events. To overcome these, leadership must champion this approach as a strategic necessity. A practical solution is to start with small-scale pilot projects, such as a scenario workshop for a specific business unit, to demonstrate value. Engaging external experts can also provide the necessary methodology and facilitate the process, helping to build internal capabilities efficiently.

Why choose Winners Consulting for Unknown-Unknowns?

Winners Consulting specializes in Unknown-Unknowns for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact

Related Services

Need help with compliance implementation?

Request Free Assessment